QSN-8862-1: libXpm vulnerability
2026-10-01

Summary:
libXpm could be made to crash if it opened a specially crafted file.

Details:
It was discovered that libXpm did not correctly handle XPM images with
zero-dimension values. A local attacker could possibly use this issue to
cause libXpm to use excessive resources, leading to a denial of service.

Affected QuantaStor releases:
  6.9.1.001 jammy: libxpm4 1:3.5.12-1ubuntu0.22.04.4 (fixed in 1:3.5.12-1ubuntu0.22.04.4)
  6.9.0.464 jammy: libxpm4 1:3.5.12-1ubuntu0.22.04.4 (fixed in 1:3.5.12-1ubuntu0.22.04.4)
  6.8.6.015 jammy: libxpm4 1:3.5.12-1ubuntu0.22.04.3 (fixed in 1:3.5.12-1ubuntu0.22.04.4)
  6.8.5.018 jammy: libxpm4 1:3.5.12-1ubuntu0.22.04.3 (fixed in 1:3.5.12-1ubuntu0.22.04.4)
  6.8.4.038 jammy: libxpm4 1:3.5.12-1ubuntu0.22.04.3 (fixed in 1:3.5.12-1ubuntu0.22.04.4)
  6.8.3.018 jammy: libxpm4 1:3.5.12-1ubuntu0.22.04.3 (fixed in 1:3.5.12-1ubuntu0.22.04.4)
  6.8.2.002 jammy: libxpm4 1:3.5.12-1ubuntu0.22.04.2 (fixed in 1:3.5.12-1ubuntu0.22.04.4)
  6.8.1.007 jammy: libxpm4 1:3.5.12-1ubuntu0.22.04.2 (fixed in 1:3.5.12-1ubuntu0.22.04.4)
  6.8.0.205 jammy: libxpm4 1:3.5.12-1ubuntu0.22.04.2 (fixed in 1:3.5.12-1ubuntu0.22.04.4)

CVEs: CVE-2026-94287

References:
  https://ubuntu.com/security/notices/USN-8862-1