Read the docs
TI-2004-00826 Aliases CVE-2004-0914GHSA-p8cv-44qj-63q8

Multiple vulnerabilities in libXpm for 6.8.1 and earlier, as used in XFree86 and other…

Priority MEDIUM 54Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Complete · Complete · Complete
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat.

Summary

Multiple vulnerabilities in libXpm for 6.8.1 and earlier, as used in XFree86 and other packages, include (1) multiple integer overflows, (2) out-of-bounds memory accesses, (3) directory traversal, (4) shell metacharacter, (5) endless loops, and (6) memory leaks, which could allow remote attackers to obtain sensitive information, cause a denial of service (application crash), or execute arbitrary code via a certain XPM image file. NOTE: it is highly likely that this candidate will be SPLIT into other candidates in the future, per CVE's content decisions.

Why it matters now

EPSS 0.08698 95th percentileScored 2026-11-07
Fix Fixed Red Hat: 5 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 40

CPEVersionsRoleVendor
cpe:2.3:a:lesstif:lesstif:0.93:*:*:*:*:*:*:*0.93VulnerableLesstif
cpe:2.3:a:lesstif:lesstif:0.93.12:*:*:*:*:*:*:*0.93.12VulnerableLesstif
cpe:2.3:a:lesstif:lesstif:0.93.18:*:*:*:*:*:*:*0.93.18VulnerableLesstif
cpe:2.3:a:lesstif:lesstif:0.93.34:*:*:*:*:*:*:*0.93.34VulnerableLesstif
cpe:2.3:a:lesstif:lesstif:0.93.36:*:*:*:*:*:*:*0.93.36VulnerableLesstif
cpe:2.3:a:lesstif:lesstif:0.93.40:*:*:*:*:*:*:*0.93.40VulnerableLesstif
cpe:2.3:a:lesstif:lesstif:0.93.91:*:*:*:*:*:*:*0.93.91VulnerableLesstif
cpe:2.3:a:lesstif:lesstif:0.93.94:*:*:*:*:*:*:*0.93.94VulnerableLesstif
cpe:2.3:a:lesstif:lesstif:0.93.96:*:*:*:*:*:*:*0.93.96VulnerableLesstif
cpe:2.3:a:x.org:x11r6:6.7.0:*:*:*:*:*:*:*6.7.0Vulnerablex.org
  • cpe:2.3:a:lesstif:lesstif:0.93:*:*:*:*:*:*:* Versions 0.93 Vulnerable ·Lesstif
  • cpe:2.3:a:lesstif:lesstif:0.93.12:*:*:*:*:*:*:* Versions 0.93.12 Vulnerable ·Lesstif
  • cpe:2.3:a:lesstif:lesstif:0.93.18:*:*:*:*:*:*:* Versions 0.93.18 Vulnerable ·Lesstif
  • cpe:2.3:a:lesstif:lesstif:0.93.34:*:*:*:*:*:*:* Versions 0.93.34 Vulnerable ·Lesstif
  • cpe:2.3:a:lesstif:lesstif:0.93.36:*:*:*:*:*:*:* Versions 0.93.36 Vulnerable ·Lesstif
  • cpe:2.3:a:lesstif:lesstif:0.93.40:*:*:*:*:*:*:* Versions 0.93.40 Vulnerable ·Lesstif
  • cpe:2.3:a:lesstif:lesstif:0.93.91:*:*:*:*:*:*:* Versions 0.93.91 Vulnerable ·Lesstif
  • cpe:2.3:a:lesstif:lesstif:0.93.94:*:*:*:*:*:*:* Versions 0.93.94 Vulnerable ·Lesstif
  • cpe:2.3:a:lesstif:lesstif:0.93.96:*:*:*:*:*:*:* Versions 0.93.96 Vulnerable ·Lesstif
  • cpe:2.3:a:x.org:x11r6:6.7.0:*:*:*:*:*:*:* Versions 6.7.0 Vulnerable ·x.org
Show 30 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:x.org:x11r6:6.8:*:*:*:*:*:*:*6.8Vulnerablex.org
cpe:2.3:a:x.org:x11r6:6.8.1:*:*:*:*:*:*:*6.8.1Vulnerablex.org
cpe:2.3:a:xfree86_project:x11r6:3.3:*:*:*:*:*:*:*3.3VulnerableXfree86 Project
cpe:2.3:a:xfree86_project:x11r6:3.3.2:*:*:*:*:*:*:*3.3.2VulnerableXfree86 Project
cpe:2.3:a:xfree86_project:x11r6:3.3.3:*:*:*:*:*:*:*3.3.3VulnerableXfree86 Project
cpe:2.3:a:xfree86_project:x11r6:3.3.4:*:*:*:*:*:*:*3.3.4VulnerableXfree86 Project
cpe:2.3:a:xfree86_project:x11r6:3.3.5:*:*:*:*:*:*:*3.3.5VulnerableXfree86 Project
cpe:2.3:a:xfree86_project:x11r6:3.3.6:*:*:*:*:*:*:*3.3.6VulnerableXfree86 Project
cpe:2.3:a:xfree86_project:x11r6:4.0:*:*:*:*:*:*:*4.0VulnerableXfree86 Project
cpe:2.3:a:xfree86_project:x11r6:4.0.1:*:*:*:*:*:*:*4.0.1VulnerableXfree86 Project
cpe:2.3:a:xfree86_project:x11r6:4.0.2.11:*:*:*:*:*:*:*4.0.2.11VulnerableXfree86 Project
cpe:2.3:a:xfree86_project:x11r6:4.0.3:*:*:*:*:*:*:*4.0.3VulnerableXfree86 Project
cpe:2.3:a:xfree86_project:x11r6:4.1.0:*:*:*:*:*:*:*4.1.0VulnerableXfree86 Project
cpe:2.3:a:xfree86_project:x11r6:4.1.11:*:*:*:*:*:*:*4.1.11VulnerableXfree86 Project
cpe:2.3:a:xfree86_project:x11r6:4.1.12:*:*:*:*:*:*:*4.1.12VulnerableXfree86 Project
cpe:2.3:a:xfree86_project:x11r6:4.2.0:*:*:*:*:*:*:*4.2.0VulnerableXfree86 Project
cpe:2.3:a:xfree86_project:x11r6:4.2.1:*:*:*:*:*:*:*4.2.1VulnerableXfree86 Project
cpe:2.3:a:xfree86_project:x11r6:4.2.1:*:errata:*:*:*:*:*4.2.1VulnerableXfree86 Project
cpe:2.3:a:xfree86_project:x11r6:4.3.0:*:*:*:*:*:*:*4.3.0VulnerableXfree86 Project
cpe:2.3:o:gentoo:linux:*:*:*:*:*:*:*:*all versionsVulnerablegentoo
cpe:2.3:o:redhat:fedora_core:core_2.0:*:*:*:*:*:*:*core_2.0VulnerableRed Hat
cpe:2.3:o:redhat:fedora_core:core_3.0:*:*:*:*:*:*:*core_3.0VulnerableRed Hat
cpe:2.3:o:suse:suse_linux:1.0:*:desktop:*:*:*:*:*1.0VulnerableSUSE
cpe:2.3:o:suse:suse_linux:8:*:enterprise_server:*:*:*:*:*8VulnerableSUSE
cpe:2.3:o:suse:suse_linux:8.1:*:*:*:*:*:*:*8.1VulnerableSUSE
cpe:2.3:o:suse:suse_linux:8.2:*:*:*:*:*:*:*8.2VulnerableSUSE
cpe:2.3:o:suse:suse_linux:9.0:*:*:*:*:*:*:*9.0VulnerableSUSE
cpe:2.3:o:suse:suse_linux:9.0:*:enterprise_server:*:*:*:*:*9.0VulnerableSUSE
cpe:2.3:o:suse:suse_linux:9.1:*:*:*:*:*:*:*9.1VulnerableSUSE
cpe:2.3:o:suse:suse_linux:9.2:*:*:*:*:*:*:*9.2VulnerableSUSE
  • cpe:2.3:a:x.org:x11r6:6.8:*:*:*:*:*:*:* Versions 6.8 Vulnerable ·x.org
  • cpe:2.3:a:x.org:x11r6:6.8.1:*:*:*:*:*:*:* Versions 6.8.1 Vulnerable ·x.org
  • cpe:2.3:a:xfree86_project:x11r6:3.3:*:*:*:*:*:*:* Versions 3.3 Vulnerable ·Xfree86 Project
  • cpe:2.3:a:xfree86_project:x11r6:3.3.2:*:*:*:*:*:*:* Versions 3.3.2 Vulnerable ·Xfree86 Project
  • cpe:2.3:a:xfree86_project:x11r6:3.3.3:*:*:*:*:*:*:* Versions 3.3.3 Vulnerable ·Xfree86 Project
  • cpe:2.3:a:xfree86_project:x11r6:3.3.4:*:*:*:*:*:*:* Versions 3.3.4 Vulnerable ·Xfree86 Project
  • cpe:2.3:a:xfree86_project:x11r6:3.3.5:*:*:*:*:*:*:* Versions 3.3.5 Vulnerable ·Xfree86 Project
  • cpe:2.3:a:xfree86_project:x11r6:3.3.6:*:*:*:*:*:*:* Versions 3.3.6 Vulnerable ·Xfree86 Project
  • cpe:2.3:a:xfree86_project:x11r6:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Xfree86 Project
  • cpe:2.3:a:xfree86_project:x11r6:4.0.1:*:*:*:*:*:*:* Versions 4.0.1 Vulnerable ·Xfree86 Project
  • cpe:2.3:a:xfree86_project:x11r6:4.0.2.11:*:*:*:*:*:*:* Versions 4.0.2.11 Vulnerable ·Xfree86 Project
  • cpe:2.3:a:xfree86_project:x11r6:4.0.3:*:*:*:*:*:*:* Versions 4.0.3 Vulnerable ·Xfree86 Project
  • cpe:2.3:a:xfree86_project:x11r6:4.1.0:*:*:*:*:*:*:* Versions 4.1.0 Vulnerable ·Xfree86 Project
  • cpe:2.3:a:xfree86_project:x11r6:4.1.11:*:*:*:*:*:*:* Versions 4.1.11 Vulnerable ·Xfree86 Project
  • cpe:2.3:a:xfree86_project:x11r6:4.1.12:*:*:*:*:*:*:* Versions 4.1.12 Vulnerable ·Xfree86 Project
  • cpe:2.3:a:xfree86_project:x11r6:4.2.0:*:*:*:*:*:*:* Versions 4.2.0 Vulnerable ·Xfree86 Project
  • cpe:2.3:a:xfree86_project:x11r6:4.2.1:*:*:*:*:*:*:* Versions 4.2.1 Vulnerable ·Xfree86 Project
  • cpe:2.3:a:xfree86_project:x11r6:4.2.1:*:errata:*:*:*:*:* Versions 4.2.1 Vulnerable ·Xfree86 Project
  • cpe:2.3:a:xfree86_project:x11r6:4.3.0:*:*:*:*:*:*:* Versions 4.3.0 Vulnerable ·Xfree86 Project
  • cpe:2.3:o:gentoo:linux:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·gentoo
  • cpe:2.3:o:redhat:fedora_core:core_2.0:*:*:*:*:*:*:* Versions core_2.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:fedora_core:core_3.0:*:*:*:*:*:*:* Versions core_3.0 Vulnerable ·Red Hat
  • cpe:2.3:o:suse:suse_linux:1.0:*:desktop:*:*:*:*:* Versions 1.0 Vulnerable ·SUSE
  • cpe:2.3:o:suse:suse_linux:8:*:enterprise_server:*:*:*:*:* Versions 8 Vulnerable ·SUSE
  • cpe:2.3:o:suse:suse_linux:8.1:*:*:*:*:*:*:* Versions 8.1 Vulnerable ·SUSE
  • cpe:2.3:o:suse:suse_linux:8.2:*:*:*:*:*:*:* Versions 8.2 Vulnerable ·SUSE
  • cpe:2.3:o:suse:suse_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·SUSE
  • cpe:2.3:o:suse:suse_linux:9.0:*:enterprise_server:*:*:*:*:* Versions 9.0 Vulnerable ·SUSE
  • cpe:2.3:o:suse:suse_linux:9.1:*:*:*:*:*:*:* Versions 9.1 Vulnerable ·SUSE
  • cpe:2.3:o:suse:suse_linux:9.2:*:*:*:*:*:*:* Versions 9.2 Vulnerable ·SUSE

Remediation

Red Hat 5 advisories

  • RHSA-2008:0524 Released 2008-06-30 · Red Hat rating Low
    Red Hat Network Satellite Server security update
    • Red Hat Satellite v 4.2 (RHEL v.3 AS) jabberd-2.0s10-3.37.rhn.i386, java-1.4.2-ibm-1.4.2.10-1jpp.2.el3.i386, java-1.4.2-ibm-devel-1.4.2.10-1jpp.2.el3.i386 +8
    • Red Hat Satellite v 4.2 (RHEL v.4 AS) jabberd-2.0s10-3.38.rhn.i386, java-1.4.2-ibm-1.4.2.10-1jpp.2.el4.i386, java-1.4.2-ibm-devel-1.4.2.10-1jpp.2.el4.i386 +8
  • RHSA-2005:004 Released 2005-01-12 · Red Hat rating Moderate
    lesstif security update
    • Red Hat Enterprise Linux AS (Advanced Server) version 2.1
    • Red Hat Enterprise Linux ES version 2.1
    • Red Hat Enterprise Linux WS version 2.1
    • Red Hat Linux Advanced Workstation 2.1
  • RHSA-2004:612 Released 2004-12-20 · Red Hat rating Moderate
    XFree86 security update
    • Red Hat Desktop version 3 XFree86-100dpi-fonts-4.3.0-78.EL, XFree86-100dpi-fonts-4.3.0-78.EL.i386, XFree86-4.3.0-78.EL +47
    • Red Hat Enterprise Linux AS version 3 XFree86-100dpi-fonts-4.3.0-78.EL, XFree86-100dpi-fonts-4.3.0-78.EL.i386, XFree86-100dpi-fonts-4.3.0-78.EL.ia64 +47
    • Red Hat Enterprise Linux ES version 3 XFree86-100dpi-fonts-4.3.0-78.EL, XFree86-100dpi-fonts-4.3.0-78.EL.i386, XFree86-100dpi-fonts-4.3.0-78.EL.ia64 +47
    • Red Hat Enterprise Linux WS version 3 XFree86-100dpi-fonts-4.3.0-78.EL, XFree86-100dpi-fonts-4.3.0-78.EL.i386, XFree86-100dpi-fonts-4.3.0-78.EL.ia64 +47
Show 2 more Red Hat advisories
  • RHSA-2004:610 Released 2004-12-20 · Red Hat rating Moderate
    XFree86 security update
    • Red Hat Enterprise Linux AS (Advanced Server) version 2.1
    • Red Hat Enterprise Linux ES version 2.1
    • Red Hat Enterprise Linux WS version 2.1
    • Red Hat Linux Advanced Workstation 2.1
  • RHSA-2004:537 Released 2004-12-02 · Red Hat rating Important
    openmotif security update
    • Red Hat Desktop version 3 openmotif-2.2.3-4.RHEL3.4, openmotif-2.2.3-4.RHEL3.4.i386, openmotif-devel-2.2.3-4.RHEL3.4 +3
    • Red Hat Enterprise Linux AS version 3 openmotif-2.2.3-4.RHEL3.4, openmotif-2.2.3-4.RHEL3.4.i386, openmotif-2.2.3-4.RHEL3.4.ia64 +8
    • Red Hat Enterprise Linux ES version 3 openmotif-2.2.3-4.RHEL3.4, openmotif-2.2.3-4.RHEL3.4.i386, openmotif-2.2.3-4.RHEL3.4.ia64 +6
    • Red Hat Enterprise Linux WS version 3 openmotif-2.2.3-4.RHEL3.4, openmotif-2.2.3-4.RHEL3.4.i386, openmotif-2.2.3-4.RHEL3.4.ia64 +6

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Desktop version 3Fixed RHSA-2004:537, RHSA-2004:612
Red Hat Enterprise Linux AS (Advanced Server) version 2.1 Fixed RHSA-2004:610
Red Hat Enterprise Linux AS version 3Fixed RHSA-2004:537, RHSA-2004:612
Red Hat Enterprise Linux ES version 2.1Fixed RHSA-2004:610
Red Hat Enterprise Linux ES version 3Fixed RHSA-2004:537, RHSA-2004:612
Red Hat Enterprise Linux WS version 2.1Fixed RHSA-2004:610
Red Hat Enterprise Linux WS version 3Fixed RHSA-2004:537, RHSA-2004:612
Red Hat Linux Advanced Workstation 2.1Fixed RHSA-2004:610
Red Hat Satellite v 4.2 (RHEL v.3 AS)Fixed RHSA-2008:0524
Red Hat Satellite v 4.2 (RHEL v.4 AS)Fixed RHSA-2008:0524

Timeline

  1. 2026-10-02 Threatist record created from CVE-2004-0914
  2. 2026-10-03 Alias added: GHSA-p8cv-44qj-63q8
  3. 2026-10-07 EPSS moved to the 95th–99th percentile

References

Patch 2

Advisory 11

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences