CVE-2023-43789

MediumCVSS 5.5/10Last modified Nov 7, 2026

Description

A vulnerability was found in libXpm where a vulnerability exists due to a boundary condition, a local user can trigger an out-of-bounds read error and read contents of memory on the system.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-125

Affected software

VendorProductVersions
——< 3.5.17
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 6—
Red HatRed Hat Enterprise Linux 7—
Red HatRed Hat Enterprise Linux 7—

References

Timeline

Published
Oct 12, 2023
Last modified
Nov 7, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-43797.5An issue has been discovered in GitLab EE affecting all versions starting from 15.3 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior toCVE-2023-437905.4iTop is an IT service management platform. By manipulating HTTP queries, a user can inject malicious content in the fields used for the objCVE-2023-437918.8Label Studio is a multi-type data labeling and annotation tool with standardized output format. There is a vulnerability that can be chainedCVE-2023-437929.8baserCMS is a website development framework. In versions 4.6.0 through 4.7.6, there is a Code Injection vulnerability in the mail form of baCVE-2023-437937.5Misskey is an open source, decentralized social media platform. Prior to version 2023.9.0, by editing the URL, a user can bypass the authentCVE-2023-437944.9Nocodb is an open source Airtable alternative. Affected versions of nocodb contain a SQL injection vulnerability, that allows an authenticatCVE-2023-437959.8GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. The OGC Web Processing ServCVE-2023-437965.3Synapse is an open-source Matrix homeserver Prior to versions 1.95.1 and 1.96.0rc1, cached device information of remote users can be queriedCVE-2023-437975.4BigBlueButton is an open-source virtual classroom. Prior to versions 2.6.11 and 2.7.0-beta.3, Guest Lobby was vulnerable to cross-site scripCVE-2023-437985.4BigBlueButton is an open-source virtual classroom. BigBlueButton prior to versions 2.6.12 and 2.7.0-rc.1 is vulnerable to Server-Side RequesCVE-2023-437997.8Altair is a GraphQL Client. Prior to version 5.2.5, the Altair GraphQL Client Desktop Application does not sanitize external URLs before pasCVE-2023-43806.3A logic flaw exists in Ansible Automation platform. Whenever a private project is created with incorrect credentials, they are logged in pla