A vulnerability was found in libXpm due to a boundary condition within the XpmCreateXpmImageFromBuffer() function. This flaw allows a local attacker to trigger an out-of-bounds read error and read the contents of memory on the system.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00023.

Exploitation none

Automatable no

Technical Impact partial

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
unaffected
Version Status Constraints
0 affected
< 3.5.17
Red Hat Red Hat Enterprise Linux 8 affected
Version Status Constraints
0:3.5.12-11.el8 unaffected
< *
Red Hat Red Hat Enterprise Linux 8 affected
Version Status Constraints
0:2.3.4-20.el8 unaffected
< *
Red Hat Red Hat Enterprise Linux 9 affected
Version Status Constraints
0:3.5.13-10.el9 unaffected
< *
Red Hat Red Hat Enterprise Linux 9 affected
Version Status Constraints
0:2.3.4-28.el9 unaffected
< *
Red Hat Red Hat Enterprise Linux 6 unknown —
Red Hat Red Hat Enterprise Linux 7 unknown —
Red Hat Red Hat Enterprise Linux 7 unknown —

Configuration 1 [-]

cpe:2.3:a:x.org:libxpm:*:*:*:*:*:*:*:*

Configuration 2 [-]

OR cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*

Configuration 3 [-]

OR cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
Package CPE Advisory Released Date
Red Hat Enterprise Linux 8
libXpm-0:3.5.12-11.el8 cpe:/a:redhat:enterprise_linux:8 RHSA-2024:2974 2024-05-22T00:00:00Z
motif-0:2.3.4-20.el8 cpe:/a:redhat:enterprise_linux:8 RHSA-2024:3022 2024-05-22T00:00:00Z
Red Hat Enterprise Linux 9
libXpm-0:3.5.13-10.el9 cpe:/a:redhat:enterprise_linux:9 RHSA-2024:2146 2024-04-30T00:00:00Z
motif-0:2.3.4-28.el9 cpe:/a:redhat:enterprise_linux:9 RHSA-2024:2217 2024-04-30T00:00:00Z

No data.

Subscriptions

Vendors Products
Fedoraproject Subscribe
Fedora Subscribe
Redhat Subscribe
Enterprise Linux Subscribe
X.org Subscribe
Libxpm Subscribe

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-3603-1 libxpm security update
Debian DSA Debian DSA DSA-5516-1 libxpm security update
EUVD EUVD EUVD-2023-48165 A vulnerability was found in libXpm due to a boundary condition within the XpmCreateXpmImageFromBuffer() function. This flaw allows a local attacker to trigger an out-of-bounds read error and read the contents of memory on the system.
Ubuntu USN Ubuntu USN USN-6408-1 libXpm vulnerabilities
Ubuntu USN Ubuntu USN USN-6408-2 libXpm vulnerabilities
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://access.redhat.com/errata/RHSA-2024:2146 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2024:2217 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2024:2974 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2024:3022 cve-icon cve-icon
https://access.redhat.com/security/cve/CVE-2023-43788 cve-icon cve-icon
https://bugzilla.redhat.com/show_bug.cgi?id=2242248 cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2023/10/msg00005.html cve-icon
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/63IBRFLQVZSMOAZBZOBKFWJP26ILRAGQ/ cve-icon
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I3KFUQT42R7TB4D7RISNSBQFJGLTQGUL/ cve-icon
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFAJTBNO3PAIA6EGZR4PN62H6RLKNDTE/ cve-icon
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/V6FARGWN7VWXXWPXYNEEDJLRR3EWFZ3T/ cve-icon
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZECBCLDYUGLDSVV75ECPIBW7JXOB3747/ cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2023-43788 cve-icon
https://www.cve.org/CVERecord?id=CVE-2023-43788 cve-icon
History

Tue, 04 Nov 2025 20:30:00 +0000

Type Values Removed Values Added
References

Mon, 16 Jun 2025 17:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 22 Nov 2024 12:00:00 +0000

Type Values Removed Values Added
References

Mon, 16 Sep 2024 15:45:00 +0000

Type Values Removed Values Added
References
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2025-11-06T22:59:44.085Z

Reserved: 2023-09-22T09:52:31.109Z

Link: CVE-2023-43788

cve-icon Vulnrichment

Updated: 2025-11-04T19:25:16.032Z

cve-icon NVD

Status : Modified

Published: 2023-10-10T13:15:22.137

Modified: 2025-11-04T20:17:07.650

Link: CVE-2023-43788

cve-icon Redhat

Severity : Moderate

Publid Date: 2023-10-04T00:00:00Z

Links: CVE-2023-43788 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses