Security Flaw in libXpm Affects File Compression Handling

CVE-2022-4883

What is CVE-2022-4883?

A security issue was identified in libXpm where it improperly handles files with .Z or .gz extensions. The library calls external programs for file compression and decompression while relying on the PATH environment variable to find these programs. This dependency can be exploited by a malicious user who manipulates the PATH, potentially leading to the execution of arbitrary programs. Users of libXpm are advised to apply security patches to mitigate this risk.

References