Hello,
m...@paianis.name (Paianis), 2023.10.03 (Tue) 14:47 (CEST):
> I wanted some cleaner pixmaps of the logo for the login greeter than
> those currently in the tree, so I remade them from the PDFs that used to
> be on the website, using mutool and imagemagick's convert.
>
> The low-color and greyscale versions are untested on suitable hardware.
>
> I don't have the ability to commit changes, the files attached are for
> anyone who can and wants to.
>
> Paianis
I tried to convert the files with xpmtoppm (from graphics/netpbm), which
complained:
xpmtoppm: Cannot find data structure declaration. Expected a line
starting with 'static char', but found the line 'static const char
*OpenBSD_15bpp[] = {
'.
Today I saw the message below, it's about the last paragraph.
+
Subject: X.Org Security Advisory: Issues in libX11 prior to 1.8.7 &
libXpm prior to 3.5.17
Date: Tue, 3 Oct 2023 09:27:22 -0700
From: Alan Coopersmith
To: xorg-annou...@lists.x.org
CC: x...@lists.x.org
X.Org Security Advisory: October 3, 2023
Issues in libX11 prior to 1.8.7 & libXpm prior to 3.5.17
Multiple issues have been found in the libX11 & libXpm libraries
published
by X.Org for which we are releasing security fixes in libX11 1.8.7 &
libXpm 3.5.17.
The first issue (CVE-2023-43785) can be triggered by connecting to an
X server that sends specially crafted replies to X11 protocol requests.
The other 4 issues can be triggered by opening specially crafted XPM
format
image files via libXpm. Two of the four issues have root causes in the
libX11 library and are fixed there, but patches have also been applied
to libXpm to avoid passing the invalid data to libX11 in the first
place.
+
$ ldd /usr/local/bin/xpmtoppm
/usr/local/bin/xpmtoppm:
StartEnd Type Open Ref GrpRef Name
0da20cf0a000 0da20cf13000 exe 10 0
/usr/local/bin/xpmtoppm
0da416126000 0da416177000 rlib 01 0
/usr/local/lib/libnetpbm.so.6.0
0da508ff2000 0da509023000 rlib 02 0
/usr/lib/libm.so.10.1
0da4ccb95000 0da4ccc8f000 rlib 02 0
/usr/lib/libc.so.97.1
0da422105000 0da422105000 ld.so 01 0
/usr/libexec/ld.so
So I figure xpmtoppm isn't affected.
OpenBSD today has a syspatch for it...
I have no idea whether the .xpm files sent yesterday are dangerous.
Nonetheless it was pretty careless of me to open a .xpm file from a
stranger on the Internet.
Marcus
