High severity · published Feb 7, 2023
CVE-2022-4883
A flaw was found in libXpm
8.8
CVSS
1.2%
EPSS
No
On KEV
Description
A flaw was found in libXpm. When processing files with .Z or .gz extensions, the library calls external programs to compress and uncompress files, relying on the PATH environment variable to find these programs, which could allow a malicious user to execute other programs by manipulating the PATH environment variable.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 68% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
Libxpm · X.org
before 3.5.15 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-4883
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-4883
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2160213
gitlab.freedesktop.org
https://gitlab.freedesktop.org/xorg/lib/libxpm/-/commit/515294bb8023a45ff91669
gitlab.freedesktop.org
https://gitlab.freedesktop.org/xorg/lib/libxpm/-/merge_requests/9
lists.debian.org
https://lists.debian.org/debian-lts-announce/2023/06/msg00021.html
lists.x.org
https://lists.x.org/archives/xorg-announce/2023-January/003312.html
More from Libxpm
9.8
CVE-2016-10164
Multiple integer overflows in libXpm before 3.5.12, when a program requests parsing XPM extensions on a 64-bit platform, allow remote attackers to cause a denial of service…
7.5
CVE-2022-46285
A flaw was found in libXpm
7.5
CVE-2022-44617
A flaw was found in libXpm
5.5
CVE-2026-94287
Denial of service via unsigned underflow in libXpm's write path
5.5
CVE-2023-43788
A vulnerability was found in libXpm due to a boundary condition within the XpmCreateXpmImageFromBuffer() function