CVE-2004-0914 Memory corruption in n/a
Remote attackers can execute arbitrary code, cause denial of service, or read sensitive data via malicious XPM image files in libXpm.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2004-0914?
CVE-2004-0914 is a critical memory corruption vulnerability in Gentoo Linux, published on 15 Dec 2004. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Multiple vulnerabilities in libXpm for 6.8.1 and earlier, as used in XFree86 and other packages, include (1) multiple integer overflows, (2) out-of-bounds memory accesses, (3) directory traversal, (4) shell metacharacter, (5) endless loops, and (6) memory leaks, which could allow remote attackers to obtain sensitive information, cause a denial of service (application crash), or execute arbitrary code via a certain XPM image file. NOTE: it is highly likely that this candidate will be SPLIT into other candidates in the future, per CVE's content decisions.
Which versions are affected by CVE-2004-0914?
It affects 6 products.
Linux distribution packages (40)
XFree86 Red Hat:enterprise_linux:3::as | All versions | 0:4.3.0-78.EL |
XFree86-100dpi-fonts Red Hat:enterprise_linux:3::as | All versions | 0:4.3.0-78.EL |
XFree86-75dpi-fonts Red Hat:enterprise_linux:3::as | All versions | 0:4.3.0-78.EL |
XFree86-ISO8859-14-100dpi-fonts Red Hat:enterprise_linux:3::as | All versions | 0:4.3.0-78.EL |
XFree86-ISO8859-14-75dpi-fonts Red Hat:enterprise_linux:3::as | All versions | 0:4.3.0-78.EL |
XFree86-ISO8859-15-100dpi-fonts Red Hat:enterprise_linux:3::as | All versions | 0:4.3.0-78.EL |
XFree86-ISO8859-15-75dpi-fonts Red Hat:enterprise_linux:3::as | All versions | 0:4.3.0-78.EL |
XFree86-ISO8859-2-100dpi-fonts Red Hat:enterprise_linux:3::as | All versions | 0:4.3.0-78.EL |
XFree86-ISO8859-2-75dpi-fonts Red Hat:enterprise_linux:3::as | All versions | 0:4.3.0-78.EL |
XFree86-ISO8859-9-100dpi-fonts Red Hat:enterprise_linux:3::as | All versions | 0:4.3.0-78.EL |
XFree86-ISO8859-9-75dpi-fonts Red Hat:enterprise_linux:3::as | All versions | 0:4.3.0-78.EL |
XFree86-Mesa-libGL Red Hat:enterprise_linux:3::as | All versions | 0:4.3.0-78.EL |
XFree86-Mesa-libGLU Red Hat:enterprise_linux:3::as | All versions | 0:4.3.0-78.EL |
XFree86-Xnest Red Hat:enterprise_linux:3::as | All versions | 0:4.3.0-78.EL |
XFree86-Xvfb Red Hat:enterprise_linux:3::as | All versions | 0:4.3.0-78.EL |
XFree86-base-fonts Red Hat:enterprise_linux:3::as | All versions | 0:4.3.0-78.EL |
XFree86-cyrillic-fonts Red Hat:enterprise_linux:3::as | All versions | 0:4.3.0-78.EL |
XFree86-devel Red Hat:enterprise_linux:3::as | All versions | 0:4.3.0-78.EL |
XFree86-doc Red Hat:enterprise_linux:3::as | All versions | 0:4.3.0-78.EL |
XFree86-font-utils Red Hat:enterprise_linux:3::as | All versions | 0:4.3.0-78.EL |
XFree86-libs Red Hat:enterprise_linux:3::as | All versions | 0:4.3.0-78.EL |
XFree86-libs-data Red Hat:enterprise_linux:3::as | All versions | 0:4.3.0-78.EL |
XFree86-sdk Red Hat:enterprise_linux:3::as | All versions | 0:4.3.0-78.EL |
XFree86-syriac-fonts Red Hat:enterprise_linux:3::as | All versions | 0:4.3.0-78.EL |
XFree86-tools Red Hat:enterprise_linux:3::as | All versions | 0:4.3.0-78.EL |
XFree86-truetype-fonts Red Hat:enterprise_linux:3::as | All versions | 0:4.3.0-78.EL |
XFree86-twm Red Hat:enterprise_linux:3::as | All versions | 0:4.3.0-78.EL |
XFree86-xauth Red Hat:enterprise_linux:3::as | All versions | 0:4.3.0-78.EL |
XFree86-xdm Red Hat:enterprise_linux:3::as | All versions | 0:4.3.0-78.EL |
XFree86-xfs Red Hat:enterprise_linux:3::as | All versions | 0:4.3.0-78.EL |
XFree86 Red Hat:enterprise_linux:3::desktop | All versions | 0:4.3.0-78.EL |
XFree86-100dpi-fonts Red Hat:enterprise_linux:3::desktop | All versions | 0:4.3.0-78.EL |
XFree86-75dpi-fonts Red Hat:enterprise_linux:3::desktop | All versions | 0:4.3.0-78.EL |
XFree86-ISO8859-14-100dpi-fonts Red Hat:enterprise_linux:3::desktop | All versions | 0:4.3.0-78.EL |
XFree86-ISO8859-14-75dpi-fonts Red Hat:enterprise_linux:3::desktop | All versions | 0:4.3.0-78.EL |
XFree86-ISO8859-15-100dpi-fonts Red Hat:enterprise_linux:3::desktop | All versions | 0:4.3.0-78.EL |
XFree86-ISO8859-15-75dpi-fonts Red Hat:enterprise_linux:3::desktop | All versions | 0:4.3.0-78.EL |
XFree86-ISO8859-2-100dpi-fonts Red Hat:enterprise_linux:3::desktop | All versions | 0:4.3.0-78.EL |
XFree86-ISO8859-2-75dpi-fonts Red Hat:enterprise_linux:3::desktop | All versions | 0:4.3.0-78.EL |
XFree86-ISO8859-9-100dpi-fonts Red Hat:enterprise_linux:3::desktop | All versions | 0:4.3.0-78.EL |
Products include Gentoo Linux, Lesstif Lesstif, Redhat Fedora Core, Suse Suse Linux, X.org X11r6, Xfree86 Project X11r6.
How do I fix CVE-2004-0914?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2004-0914 being exploited?
There is no known exploitation of CVE-2004-0914 in the wild and no public exploit code.
Other vulnerabilities in Gentoo Linux
Sources
Also known as DSA-607-1, GHSA-p8cv-44qj-63q8, RHSA-2004:612.