maintainer-feedback requested: [Bug 274265] x11/libXpm: update vulnerable port to 3.5.17
| Newsgroups | gmane.os.freebsd.devel.x11 |
|---|---|
| Message-ID | <[email protected]/bugzilla/> |
Bugzilla Automation <[email protected]> has asked freebsd-x11 (Nobody) <[email protected]> for maintainer-feedback: Bug 274265: x11/libXpm: update vulnerable port to 3.5.17 https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=274265 --- Description --- X11 has published a security bulletin [1] that exposes the following CVEs in our x11/libXpm version 3.5.15: CVE-2023-43786: stack exhaustion in XPutImage CVE-2023-43787: integer overflow in XCreateImage CVE-2023-43788: Out of bounds read in XpmCreateXpmImageFromBuffer CVE-2023-43789: Out of bounds read on XPM with corrupted colormap See changelog for a full list of changes in the release [2]. The attached patch bumps the Makefile and distinfo. 1. https://lists.x.org/archives/xorg/2023-October/061506.html 2. https://gitlab.freedesktop.org/xorg/lib/libxpm/-/compare/libXpm-3.5.15...libXpm -3.5.17