CVE-2004-0688

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 7.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2004-10-20 · updated 2026-06-16

Description

Multiple integer overflows in (1) the xpmParseColors function in parse.c, (2) XpmCreateImageFromXpmImage, (3) CreateXImage, (4) ParsePixels, and (5) ParseAndPutPixels for libXpm before 6.8.1 may allow remote attackers to execute arbitrary code via a malformed XPM image file.

Affected products

OpenBSD: 3.4, 3.5
Suse Linux: 8, 8.1, 8.2, 9.0, 9.1
X.Org X11R6: 6.7.0, 6.8
Xfree86 Project X11R6: 3.3.6, 4.0, 4.0.1, 4.0.2.11, 4.0.3, 4.1.0 (+5)

References

http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000924
http://ftp.x.org/pub/X11R6.8.0/patches/README.xorg-CAN-2004-0687-0688.patch
http://lists.apple.com/archives/security-announce/2005/May/msg00001.html
http://marc.info/?l=bugtraq&m=109530851323415&w=2
http://scary.beasts.org/security/CESA-2004-003.txt
http://secunia.com/advisories/20235
http://sunsolve.sun.com/search/document.do?assetkey=1-26-57653-1
http://www.debian.org/security/2004/dsa-560
http://www.gentoo.org/security/en/glsa/glsa-200409-34.xml
http://www.gentoo.org/security/en/glsa/glsa-200502-07.xml
http://www.kb.cert.org/vuls/id/537878
http://www.mandriva.com/security/advisories?name=MDKSA-2004:098

Get alerted when CVE-2004-0688 or the next vulnerability affects your stack