CVE-2016-10164 Integer overflow in n/a
Remote attackers can execute arbitrary code or cause denial of service via crafted XPM files due to integer overflows in libXpm.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-10164?
CVE-2016-10164 is a critical vulnerability in n/a, published on 1 Feb 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Multiple integer overflows in libXpm before 3.5.12, when a program requests parsing XPM extensions on a 64-bit platform, allow remote attackers to cause a denial of service (out-of-bounds write) or execute arbitrary code via (1) the number of extensions or (2) their concatenated length in a crafted XPM file, which triggers a heap-based buffer overflow.
Which versions are affected by CVE-2016-10164?
It affects 1 product.
Linux distribution packages (12)
libXpm SUSE:Linux Enterprise Desktop 12 SP1 | All versions | 3.5.11-5.1 |
libXpm SUSE:Linux Enterprise Desktop 12 SP2 | All versions | 3.5.11-5.1 |
xorg-x11-libXpm SUSE:Linux Enterprise Server 11 SP4 | All versions | 7.4-3.1 |
libXpm SUSE:Linux Enterprise Server 12 SP1 | All versions | 3.5.11-5.1 |
libXpm SUSE:Linux Enterprise Server 12 SP2 | All versions | 3.5.11-5.1 |
libXpm SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2 | All versions | 3.5.11-5.1 |
xorg-x11-libXpm SUSE:Linux Enterprise Server for SAP Applications 11 SP4 | All versions | 7.4-3.1 |
libXpm SUSE:Linux Enterprise Server for SAP Applications 12 SP1 | All versions | 3.5.11-5.1 |
libXpm SUSE:Linux Enterprise Server for SAP Applications 12 SP2 | All versions | 3.5.11-5.1 |
xorg-x11-libXpm SUSE:Linux Enterprise Software Development Kit 11 SP4 | All versions | 7.4-3.1 |
libXpm SUSE:Linux Enterprise Software Development Kit 12 SP1 | All versions | 3.5.11-5.1 |
libXpm SUSE:Linux Enterprise Software Development Kit 12 SP2 | All versions | 3.5.11-5.1 |
Products include X.org Libxpm.
How do I fix CVE-2016-10164?
Upgrade to a fixed version.
Is CVE-2016-10164 being exploited?
There is no known exploitation of CVE-2016-10164 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as ALPINE-CVE-2016-10164, DEBIAN-CVE-2016-10164, DLA-801-1, DSA-3772-1, GHSA-fhfv-mh3h-f699, MGASA-2017-0035 and 4 more.