CVE-2022-4883
A flaw was found in libXpm.
Published Feb 7, 2023 · updated Oct 15, 2026
A flaw was found in libXpm. When processing files with .Z or .gz extensions, the library calls external programs to compress and uncompress files, relying on the PATH environment variable to find these programs, which could allow a malicious user to execute other programs by manipulating the PATH environment variable.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Feb 7, 2023 · OSV.dev
Detected
A flaw was found in libXpm. When processing files with .Z or .gz extensions, the library calls external programs to compress and uncompress files, relying on the PATH environment variable to find these programs, which could allow a malicious user to execute other programs by manipulating the PATH environment variable.
Oct 15, 2026 · OSV.dev
Fix available
libxpm fixed in 3.5.15-r0; libxpm fixed in 3.5.15-r0; libxpm fixed in 3.5.15-r0; libxpm fixed in 3.5.15-r0
Oct 15, 2026 · OSV.dev
Fix available
libxpm fixed in 3.5.15-r0
Oct 15, 2026 · OSV.dev
Updated
A flaw was found in libXpm. When processing files with .Z or .gz extensions, the library calls external programs to compress and uncompress files, relying on the PATH environment variable to find these programs, which could allow a malicious user to execute other programs by manipulating the PATH environment variable.
Affected
- Alpine:v3.14 libxpm0 → 3.5.15-r0
- Alpine:v3.15 libxpm0 → 3.5.15-r0
- Alpine:v3.16 libxpm0 → 3.5.15-r0
- Alpine:v3.17 libxpm0 → 3.5.15-r0
- Alpine:v3.18 libxpm0 → 3.5.15-r0
- Alpine:v3.19 libxpm0 → 3.5.15-r0
- Alpine:v3.20 libxpm0 → 3.5.15-r0
- Alpine:v3.21 libxpm0 → 3.5.15-r0
- Alpine:v3.22 libxpm0 → 3.5.15-r0
- Alpine:v3.23 libxpm0 → 3.5.15-r0
- Alpine:v3.24 libxpm0 → 3.5.15-r0