CVE-2004-0914: Gentoo Linux

High severity, CVSS 10.0. EPSS: 8.7% chance of exploitation in the next 30 days.

Multiple vulnerabilities in libXpm for 6.8.1 and earlier, as used in XFree86 and other packages, include (1) multiple integer overflows, (2) out-of-bounds memory accesses, (3) directory traversal, (4) shell metacharacter, (5) endless loops, and (6) memory leaks, which could allow remote attackers to obtain sensitive information, cause a denial of service (application crash), or execute arbitrary code via a certain XPM image file. NOTE: it is highly likely that this candidate will be SPLIT into other candidates in the future, per CVE's content decisions.

Affected products

• Gentoo Linux: any version
• Lesstif Lesstif: version 0.93 only; version 0.93.12 only; version 0.93.18 only; version 0.93.34 only; version 0.93.36 only; version 0.93.40 only; …
• Red Hat Fedora Core: version core_2.0 only; version core_3.0 only
• Suse Suse Linux: version 1.0 only; version 8 only; version 8.1 only; version 8.2 only; version 9.0 only; version 9.1 only; …
• X.org x11r6: version 6.7.0 only; version 6.8 only; version 6.8.1 only
• XFREE86 Project x11r6: version 3.3 only; version 3.3.2 only; version 3.3.3 only; version 3.3.4 only; version 3.3.5 only; version 3.3.6 only; …

Published 2005-01-10. Last modified 2026-06-16.