CVE-2016-10164
CriticalSummary
Multiple integer overflows in libXpm before version 3.5.12 can lead to remote denial of service or arbitrary code execution. The issue occurs when a program requests parsing XPM extensions on a 64-bit platform, potentially causing a heap-based buffer overflow.
Risk Assessment
An attacker could exploit this vulnerability to execute remote code or cause service outages, leading to serious consequences for the organization.
Recommendation
It is recommended to update libXpm to version 3.5.12 or later to mitigate this vulnerability.
Original NVD description (English source)
Multiple integer overflows in libXpm before 3.5.12, when a program requests parsing XPM extensions on a 64-bit platform, allow remote attackers to cause a denial of service (out-of-bounds write) or execute arbitrary code via (1) the number of extensions or (2) their concatenated length in a crafted XPM file, which triggers a heap-based buffer overflow.