# CVE-2023-43789: libxpm: A vulnerability was found in libXpm where a vulnerability exists due to a boundary condition, a local user can trigge...

CVE-2023-43789 is fixed in 11 products on 1 platform, first by libxpm4 1:3.5.12-1ubuntu0.18.04.2+esm1, released October 2, 2023. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2023-43789
- Priority: Routine
- CVSS: 5.5 (medium)
- EPSS: 0.0036
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Oct 2, 2023

## Description

A vulnerability was found in libXpm where a vulnerability exists due to a boundary condition, a local user can trigger an out-of-bounds read error and read contents of memory on the system.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | libXpm RHEL 8 | 0:3.5.12-11.el8 | [RHSA-2024:2974](https://patchblox.com/security/data/fix/linux/rhsa-2024-2974.md) | May 22, 2024 |
| Linux | libXpm RHEL 9 | 0:3.5.13-10.el9 | [RHSA-2024:2146](https://patchblox.com/security/data/fix/linux/rhsa-2024-2146.md) | Apr 30, 2024 |
| Linux | libXpm almalinux 8 | 3.5.12-11.el8 | [ALSA-2024:2974](https://patchblox.com/security/data/fix/linux/alsa-2024-2974.md) | May 22, 2024 |
| Linux | libXpm almalinux 9 | 3.5.13-10.el9 | [ALSA-2024:2146](https://patchblox.com/security/data/fix/linux/alsa-2024-2146.md) | Apr 30, 2024 |
| Linux | libXpm amzn 2023 | 3.5.15-2.amzn2023.0.3 | [ALAS2023-2023-382](https://patchblox.com/security/data/fix/linux/alas2023-2023-382.md) | Oct 12, 2023 |
| Linux | libXpm ol 8 | 0:3.5.12-11.el8 | [ELSA-2024-2974](https://patchblox.com/security/data/fix/linux/elsa-2024-2974.md) | May 23, 2024 |
| Linux | libXpm ol 9 | 0:3.5.13-10.el9 | [ELSA-2024-2146](https://patchblox.com/security/data/fix/linux/elsa-2024-2146.md) | May 2, 2024 |
| Linux | libXpm rocky 8 | 0:3.5.12-11.el8 | [RLSA-2024:2974](https://patchblox.com/security/data/fix/linux/rlsa-2024-2974.md) | Jun 14, 2024 |
| Linux | libXpm rocky 9 | 0:3.5.13-10.el9 | [RLSA-2024:2146](https://patchblox.com/security/data/fix/linux/rlsa-2024-2146.md) | May 7, 2025 |
| Linux | libXpm-debuginfo amzn 2023 | 3.5.15-2.amzn2023.0.3 | [ALAS2023-2023-382](https://patchblox.com/security/data/fix/linux/alas2023-2023-382.md) | Oct 12, 2023 |
| Linux | libXpm-debugsource amzn 2023 | 3.5.15-2.amzn2023.0.3 | [ALAS2023-2023-382](https://patchblox.com/security/data/fix/linux/alas2023-2023-382.md) | Oct 12, 2023 |
| Linux | libXpm-devel RHEL 8 | 0:3.5.12-11.el8 | [RHSA-2024:2974](https://patchblox.com/security/data/fix/linux/rhsa-2024-2974.md) | May 22, 2024 |
| Linux | libXpm-devel RHEL 9 | 0:3.5.13-10.el9 | [RHSA-2024:2146](https://patchblox.com/security/data/fix/linux/rhsa-2024-2146.md) | Apr 30, 2024 |
| Linux | libXpm-devel almalinux 8 | 3.5.12-11.el8 | [ALSA-2024:2974](https://patchblox.com/security/data/fix/linux/alsa-2024-2974.md) | May 22, 2024 |
| Linux | libXpm-devel almalinux 9 | 3.5.13-10.el9 | [ALSA-2024:2146](https://patchblox.com/security/data/fix/linux/alsa-2024-2146.md) | Apr 30, 2024 |
| Linux | libXpm-devel amzn 2023 | 3.5.15-2.amzn2023.0.3 | [ALAS2023-2023-382](https://patchblox.com/security/data/fix/linux/alas2023-2023-382.md) | Oct 12, 2023 |
| Linux | libXpm-devel ol 8 | 0:3.5.12-11.el8 | [ELSA-2024-2974](https://patchblox.com/security/data/fix/linux/elsa-2024-2974.md) | May 23, 2024 |
| Linux | libXpm-devel ol 9 | 0:3.5.13-10.el9 | [ELSA-2024-2146](https://patchblox.com/security/data/fix/linux/elsa-2024-2146.md) | May 2, 2024 |
| Linux | libXpm-devel-debuginfo amzn 2023 | 3.5.15-2.amzn2023.0.3 | [ALAS2023-2023-382](https://patchblox.com/security/data/fix/linux/alas2023-2023-382.md) | Oct 12, 2023 |
| Linux | libxpm Debian 12.15 (bookworm) | 1:3.5.12-1.1+deb12u1 | [DEBIAN-CVE-2023-43789](https://patchblox.com/security/data/fix/linux/debian-cve-2023-43789.md) | Oct 12, 2023 |
| Linux | libxpm Debian 13.5 (trixie) | 1:3.5.17-1 | [DEBIAN-CVE-2023-43789](https://patchblox.com/security/data/fix/linux/debian-cve-2023-43789.md) | Oct 12, 2023 |
| Linux | libxpm Debian 14 | 1:3.5.17-1 | [DEBIAN-CVE-2023-43789](https://patchblox.com/security/data/fix/linux/debian-cve-2023-43789.md) | Oct 12, 2023 |
| Linux | libxpm4 Ubuntu 18.04.6 LTS (bionic) | 1:3.5.12-1ubuntu0.18.04.2+esm1 | [libxpm4 1:3.5.12-1ubuntu0.18.04.2+esm1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libxpm4-1-3.5.12-1ubuntu0.18.04.2-esm1.md) | Oct 2, 2023 |
| Linux | libxpm4 Ubuntu 20.04 LTS (focal) | 1:3.5.12-1ubuntu0.20.04.2 | [libxpm4 1:3.5.12-1ubuntu0.20.04.2](https://patchblox.com/security/data/fix/linux/ubuntu-focal-libxpm4-1-3.5.12-1ubuntu0.20.04.2.md) | Oct 2, 2023 |
| Linux | libxpm4 Ubuntu 22.04.1 LTS (jammy) | 1:3.5.12-1ubuntu0.22.04.2 | [libxpm4 1:3.5.12-1ubuntu0.22.04.2](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libxpm4-1-3.5.12-1ubuntu0.22.04.2.md) | Oct 2, 2023 |
| Linux | libxpm4 Ubuntu 24.04.5 LTS (noble) | 1:3.5.12-1.1ubuntu1 | [libxpm4 1:3.5.12-1.1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libxpm4-1-3.5.12-1.1ubuntu1.md) | Oct 2, 2023 |
| Linux | libxpm4 Ubuntu 24.10 (oracular) | 1:3.5.12-1.1ubuntu1 | [libxpm4 1:3.5.12-1.1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-libxpm4-1-3.5.12-1.1ubuntu1.md) | Oct 3, 2023 |
| Linux | libxpm4 Ubuntu 25.04 (plucky) | 1:3.5.12-1.1ubuntu1 | [libxpm4 1:3.5.12-1.1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-libxpm4-1-3.5.12-1.1ubuntu1.md) | Oct 3, 2023 |
| Linux | motif RHEL 8 | 0:2.3.4-20.el8 | [RHSA-2024:3022](https://patchblox.com/security/data/fix/linux/rhsa-2024-3022.md) | May 22, 2024 |
| Linux | motif RHEL 9 | 0:2.3.4-28.el9 | [RHSA-2024:2217](https://patchblox.com/security/data/fix/linux/rhsa-2024-2217.md) | Apr 30, 2024 |
| Linux | motif almalinux 8 | 2.3.4-20.el8 | [ALSA-2024:3022](https://patchblox.com/security/data/fix/linux/alsa-2024-3022.md) | May 22, 2024 |
| Linux | motif almalinux 9 | 2.3.4-28.el9 | [ALSA-2024:2217](https://patchblox.com/security/data/fix/linux/alsa-2024-2217.md) | Apr 30, 2024 |
| Linux | motif ol 8 | 0:2.3.4-20.el8 | [ELSA-2024-3022](https://patchblox.com/security/data/fix/linux/elsa-2024-3022.md) | May 23, 2024 |
| Linux | motif ol 9 | 0:2.3.4-28.el9 | [ELSA-2024-2217](https://patchblox.com/security/data/fix/linux/elsa-2024-2217.md) | May 2, 2024 |
| Linux | motif rocky 8 | 0:2.3.4-20.el8 | [RLSA-2024:3022](https://patchblox.com/security/data/fix/linux/rlsa-2024-3022.md) | May 7, 2025 |
| Linux | motif rocky 9 | 0:2.3.4-28.el9 | [RLSA-2024:2217](https://patchblox.com/security/data/fix/linux/rlsa-2024-2217.md) | May 7, 2025 |
| Linux | motif-devel RHEL 8 | 0:2.3.4-20.el8 | [RHSA-2024:3022](https://patchblox.com/security/data/fix/linux/rhsa-2024-3022.md) | May 22, 2024 |
| Linux | motif-devel RHEL 9 | 0:2.3.4-28.el9 | [RHSA-2024:2217](https://patchblox.com/security/data/fix/linux/rhsa-2024-2217.md) | Apr 30, 2024 |
| Linux | motif-devel almalinux 8 | 2.3.4-20.el8 | [ALSA-2024:3022](https://patchblox.com/security/data/fix/linux/alsa-2024-3022.md) | May 22, 2024 |
| Linux | motif-devel almalinux 9 | 2.3.4-28.el9 | [ALSA-2024:2217](https://patchblox.com/security/data/fix/linux/alsa-2024-2217.md) | Apr 30, 2024 |
| Linux | motif-devel ol 8 | 0:2.3.4-20.el8 | [ELSA-2024-3022](https://patchblox.com/security/data/fix/linux/elsa-2024-3022.md) | May 23, 2024 |
| Linux | motif-devel ol 9 | 0:2.3.4-28.el9 | [ELSA-2024-2217](https://patchblox.com/security/data/fix/linux/elsa-2024-2217.md) | May 2, 2024 |
| Linux | motif-static RHEL 8 | 0:2.3.4-20.el8 | [RHSA-2024:3022](https://patchblox.com/security/data/fix/linux/rhsa-2024-3022.md) | May 22, 2024 |
| Linux | motif-static almalinux 8 | 2.3.4-20.el8 | [ALSA-2024:3022](https://patchblox.com/security/data/fix/linux/alsa-2024-3022.md) | May 22, 2024 |
| Linux | motif-static ol 8 | 0:2.3.4-20.el8 | [ELSA-2024-3022](https://patchblox.com/security/data/fix/linux/elsa-2024-3022.md) | May 23, 2024 |
| Linux | xpmutils Ubuntu 18.04.6 LTS (bionic) | 1:3.5.12-1ubuntu0.18.04.2+esm1 | [xpmutils 1:3.5.12-1ubuntu0.18.04.2+esm1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-xpmutils-1-3.5.12-1ubuntu0.18.04.2-esm1.md) | Oct 2, 2023 |
| Linux | xpmutils Ubuntu 20.04 LTS (focal) | 1:3.5.12-1ubuntu0.20.04.2 | [xpmutils 1:3.5.12-1ubuntu0.20.04.2](https://patchblox.com/security/data/fix/linux/ubuntu-focal-xpmutils-1-3.5.12-1ubuntu0.20.04.2.md) | Oct 2, 2023 |
| Linux | xpmutils Ubuntu 22.04.1 LTS (jammy) | 1:3.5.12-1ubuntu0.22.04.2 | [xpmutils 1:3.5.12-1ubuntu0.22.04.2](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-xpmutils-1-3.5.12-1ubuntu0.22.04.2.md) | Oct 2, 2023 |
| Linux | xpmutils Ubuntu 24.04.5 LTS (noble) | 1:3.5.12-1.1ubuntu1 | [xpmutils 1:3.5.12-1.1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-xpmutils-1-3.5.12-1.1ubuntu1.md) | Oct 2, 2023 |
| Linux | xpmutils Ubuntu 24.10 (oracular) | 1:3.5.12-1.1ubuntu1 | [xpmutils 1:3.5.12-1.1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-xpmutils-1-3.5.12-1.1ubuntu1.md) | Oct 3, 2023 |
| Linux | xpmutils Ubuntu 25.04 (plucky) | 1:3.5.12-1.1ubuntu1 | [xpmutils 1:3.5.12-1.1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-xpmutils-1-3.5.12-1.1ubuntu1.md) | Oct 3, 2023 |

---

Data as of 2026-11-08T06:59:42Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.