Bug 2163813 (CVE-2023-24039) - CVE-2023-24039 motif: libXm: stack-based buffer overflow in ParseColors()
Summary: CVE-2023-24039 motif: libXm: stack-based buffer overflow in ParseColors()
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2023-24039
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2163814
Blocks: 2164418
TreeView+ depends on / blocked
 
Reported: 2023-01-24 13:34 UTC by Mauro Matteo Cascella
Modified: 2023-02-01 20:25 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2023-01-27 20:22:20 UTC
Embargoed:


Attachments (Terms of Use)

Description Mauro Matteo Cascella 2023-01-24 13:34:06 UTC
A stack-based buffer overflow was found in the ParseColors() function of libXm. This vulnerability is caused by the unchecked use of the unsafe API function strcat() and can be triggered via a specially crafted XPM icon with long color strings. The flaw was demonstrated to be exploitable by local unprivileged users via the dtprintinfo setuid binary to achieve local privilege escalation to root on Solaris 10.

*NOTE* The dtprintinfo setuid binary is not distributed with Red Hat Enterprise Linux. Red Hat never provided support for CDE (Common Desktop Environment). See https://access.redhat.com/solutions/5547801 for more information.

References:
https://security.humanativaspa.it/nothing-new-under-the-sun/
https://github.com/hnsecurity/vulns/blob/main/HNS-2022-01-dtprintinfo.txt

Comment 1 Mauro Matteo Cascella 2023-01-24 13:34:36 UTC
Created libXpm tracking bugs for this issue:

Affects: fedora-all [bug 2163814]

Comment 2 Peter Hutterer 2023-01-24 23:52:21 UTC
Note that this issue is in libXm (i.e. motif), not libXpm the X11 Pixmap library.

Comment 3 Product Security DevOps Team 2023-01-27 20:22:18 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2023-24039


Note You need to log in before you can comment on or make changes to this bug.