Ce mail provient de l'extérieur, restons vigilants ===================================================================== CERT-Renater Note d'Information No. 2026/VULN416 _____________________________________________________________________ DATE : 23/04/2026 HARDWARE PLATFORM(S): / OPERATING SYSTEM(S): Systems running libXpm versions prior to 3.5.19. ===================================================================== https://lists.x.org/archives/xorg-announce/2026-April/003690.html _____________________________________________________________________ ====================================================================== X.Org Security Advisory: April 21, 2026 Issue in libXpm prior to version 3.5.19 ====================================================================== An issue has been found in the libXpm library published by X.Org for which we are releasing a security fix for in libXpm-3.5.19. * CVE-2026-4367: libXpm Out-of-bounds read in xpmNextWord() libXpm uses a number of internal helper functions to parse the XPM file format. One of these internal functions, xpmNextString(), checks for the NULL terminator when looking for the end of the current string but not when looking for the beginning of the next string. A small XPM file with a malformed color table definition may cause the function xpmNextWord(), called from xpmParseColors() following a call to xpmNextString(), to start past the actual end of the file, causing an out-of-bound read. Introduced in: Unknown, prior to 3.5.5 (from Xorg 7.1) Fixed in: libXpm-3.5.19 Fix: https://gitlab.freedesktop.org/xorg/lib/libxpm/-/commit/5448e1bd Found by: Naoki Wakamatsu -------------- next part -------------- A non-text attachment was scrubbed... Name: OpenPGP_0x14706DBE1E4B4540.asc Type: application/pgp-keys Size: 2988 bytes Desc: OpenPGP public key URL: -------------- next part -------------- A non-text attachment was scrubbed... Name: OpenPGP_signature.asc Type: application/pgp-signature Size: 203 bytes Desc: OpenPGP digital signature URL: ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 23/25 Rue Daviel | fax : 01-53-94-20-41 + + 75013 Paris | email:cert@support.renater.fr + =========================================================