Skip to content
Fencer Vulns
high 7.5

CVE-2005-0605 json

scan.c for LibXPM may allow attackers to execute arbitrary code via a negative bitmap_unit value that leads to a buffer overflow.

published 2005-03-02 21 y ago modified 2026-06-16 4 mo ago also EUVD-2005-0606

cvss
7.5
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
4.5%
EPSS 4.5% chance of exploitation in 30 days, percentile 91%
public exploits
0
none known

Summary

scan.c for LibXPM may allow attackers to execute arbitrary code via a negative bitmap_unit value that leads to a buffer overflow.

Patch / fix

  • xorg-x11 RHEL 4 6.8.2-1.EL.13.6
  • fonts-xorg RHEL 4 6.8.1.1-1.EL.1
  • xorg-x11-sdk RHEL 4 6.8.2-1.EL.13.6
  • xorg-x11-twm RHEL 4 6.8.2-1.EL.13.6
  • xorg-x11-xdm RHEL 4 6.8.2-1.EL.13.6
  • xorg-x11-xfs RHEL 4 6.8.2-1.EL.13.6
  • xorg-x11-libs RHEL 4 6.8.2-1.EL.13.6
  • xorg-x11-Xdmx RHEL 4 6.8.2-1.EL.13.6

red hat advisories RHSA-2005:198RHSA-2008:0524RHSA-2008:0261RHSA-2005:412RHSA-2005:331

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2005-0605 updated

libxpm buffer overflow

  • Red Hat Desktop version 3 XFree86 4.3.0-81.EL, XFree86-sdk 4.3.0-81.EL, XFree86-twm 4.3.0-81.EL, XFree86-xdm 4.3.0-81.EL, XFree86-xfs 4.3.0-81.EL, XFree86-libs 4.3.0-81.EL, +24 more Red Hat Enterprise Linux AS version 3 XFree86 4.3.0-81.EL, XFree86-sdk 4.3.0-81.EL, XFree86-twm 4.3.0-81.EL, XFree86-xdm 4.3.0-81.EL, XFree86-xfs 4.3.0-81.EL, XFree86-libs 4.3.0-81.EL, +24 more
    fixed: vendor fix RHSA-2005:331
  • Red Hat Enterprise Linux AS version 4 xorg-x11 6.8.2-1.EL.13.6, fonts-xorg 6.8.1.1-1.EL.1, openmotif 2.2.3-9.RHEL4.1, xorg-x11-sdk 6.8.2-1.EL.13.6, xorg-x11-twm 6.8.2-1.EL.13.6, xorg-x11-xdm 6.8.2-1.EL.13.6, +26 more Red Hat Enterprise Linux Desktop version 4 xorg-x11 6.8.2-1.EL.13.6, fonts-xorg 6.8.1.1-1.EL.1, openmotif 2.2.3-9.RHEL4.1, xorg-x11-sdk 6.8.2-1.EL.13.6, xorg-x11-twm 6.8.2-1.EL.13.6, xorg-x11-xdm 6.8.2-1.EL.13.6, +26 more
    fixed: vendor fix RHSA-2005:412
  • Red Hat Enterprise Linux ES version 2.1
    fixed: vendor fix RHSA-2005:044
  • Red Hat Enterprise Linux ES version 3 XFree86 4.3.0-81.EL, XFree86-sdk 4.3.0-81.EL, XFree86-twm 4.3.0-81.EL, XFree86-xdm 4.3.0-81.EL, XFree86-xfs 4.3.0-81.EL, XFree86-libs 4.3.0-81.EL, +24 more
    fixed: vendor fix RHSA-2005:331
  • Red Hat Enterprise Linux ES version 4 xorg-x11 6.8.2-1.EL.13.6, fonts-xorg 6.8.1.1-1.EL.1, openmotif 2.2.3-9.RHEL4.1, xorg-x11-sdk 6.8.2-1.EL.13.6, xorg-x11-twm 6.8.2-1.EL.13.6, xorg-x11-xdm 6.8.2-1.EL.13.6, +26 more
    fixed: vendor fix RHSA-2005:412
  • Red Hat Enterprise Linux WS version 2.1
    fixed: vendor fix RHSA-2005:044
  • Red Hat Enterprise Linux WS version 3 XFree86 4.3.0-81.EL, XFree86-sdk 4.3.0-81.EL, XFree86-twm 4.3.0-81.EL, XFree86-xdm 4.3.0-81.EL, XFree86-xfs 4.3.0-81.EL, XFree86-libs 4.3.0-81.EL, +24 more
    fixed: vendor fix RHSA-2005:331
  • Red Hat Enterprise Linux WS version 4 xorg-x11 6.8.2-1.EL.13.6, fonts-xorg 6.8.1.1-1.EL.1, openmotif 2.2.3-9.RHEL4.1, xorg-x11-sdk 6.8.2-1.EL.13.6, xorg-x11-twm 6.8.2-1.EL.13.6, xorg-x11-xdm 6.8.2-1.EL.13.6, +26 more
    fixed: vendor fix RHSA-2005:412
show 3 more
  • Red Hat Linux Advanced Workstation 2.1
    fixed: vendor fix RHSA-2005:044
  • Red Hat Satellite 5.0 (RHEL v.4 AS) jabberd 2.0s10-3.38.rhn, jfreechart 0.9.20-3.rhn, tomcat5 5.0.30-0jpp_10rh, perl-Crypt-CBC 2.24-1.el4, rhn-modperl 1.29-16.rhel4, openmotif21 2.1.30-11.RHEL4.6, +4 more
    fixed: vendor fix RHSA-2008:0261
  • Red Hat Satellite v 4.2 (RHEL v.3 AS) jabberd 2.0s10-3.37.rhn, jfreechart 0.9.20-3.rhn, tomcat5 5.0.30-0jpp_10rh, perl-Crypt-CBC 2.24-1.el3, rhn-modperl 1.29-16.rhel3, openmotif21 2.1.30-9.RHEL3.8, +4 more Red Hat Satellite v 4.2 (RHEL v.4 AS) jabberd 2.0s10-3.38.rhn, jfreechart 0.9.20-3.rhn, tomcat5 5.0.30-0jpp_10rh, perl-Crypt-CBC 2.24-1.el4, rhn-modperl 1.29-16.rhel4, openmotif21 2.1.30-11.RHEL4.6, +4 more
    fixed: vendor fix RHSA-2008:0524

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

4.51% chance of exploitation in the next 30 days, higher than 91% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.