maintainer-feedback requested: [Bug 274265] x11/libXpm: update vulnerable port to 3.5.17

[email protected]
Newsgroups gmane.os.freebsd.devel.x11
Message-ID <[email protected]/bugzilla/>
Bugzilla Automation <[email protected]> has asked freebsd-x11 (Nobody)
<[email protected]> for maintainer-feedback:
Bug 274265: x11/libXpm: update vulnerable port to 3.5.17
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=274265



--- Description ---
X11 has published a security bulletin [1] that exposes the following CVEs in
our x11/libXpm version 3.5.15:

CVE-2023-43786: stack exhaustion in XPutImage
CVE-2023-43787: integer overflow in XCreateImage
CVE-2023-43788: Out of bounds read in XpmCreateXpmImageFromBuffer
CVE-2023-43789: Out of bounds read on XPM with corrupted colormap

See changelog for a full list of changes in the release [2].

The attached patch bumps the Makefile and distinfo.

1. https://lists.x.org/archives/xorg/2023-October/061506.html
2.
https://gitlab.freedesktop.org/xorg/lib/libxpm/-/compare/libXpm-3.5.15...libXpm
-3.5.17
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.