CVE-2004-0688: OpenBSD

High severity, CVSS 7.5. EPSS: 7.3% chance of exploitation in the next 30 days.

Multiple integer overflows in (1) the xpmParseColors function in parse.c, (2) XpmCreateImageFromXpmImage, (3) CreateXImage, (4) ParsePixels, and (5) ParseAndPutPixels for libXpm before 6.8.1 may allow remote attackers to execute arbitrary code via a malformed XPM image file.

Affected products

• OpenBSD OpenBSD: version 3.4 only; version 3.5 only
• Suse Suse Linux: version 8 only; version 8.1 only; version 8.2 only; version 9.0 only; version 9.1 only
• X.org x11r6: version 6.7.0 only; version 6.8 only
• XFREE86 Project x11r6: version 3.3.6 only; version 4.0 only; version 4.0.1 only; version 4.0.2.11 only; version 4.0.3 only; version 4.1.0 only; …

Published 2004-10-20. Last modified 2026-06-16.