CVE-2022-4883
HIGHlibXpm < 3.5.15 - Untrusted Search Path via PATH Environment Variable Manipulation
Title source: llmDescription
A flaw was found in libXpm. When processing files with .Z or .gz extensions, the library calls external programs to compress and uncompress files, relying on the PATH environment variable to find these programs, which could allow a malicious user to execute other programs by manipulating the PATH environment variable.
References (5)
Core 5
Core References
Issue Tracking, Patch, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2160213
Mailing List mailing-list
https://lists.debian.org/debian-lts-announce/2023/06/msg00021.html
Scores
CVSS v3
8.8
EPSS
0.0120
EPSS Percentile
64.0%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-426
Status
published
Products (1)
x.org/libxpm
< 3.5.15
Published
Feb 07, 2023
Tracked Since
Feb 18, 2026