{"action":"Upgrade libxpm to 3.5.15-r0 or later.","affected":[{"fixed":"3.5.15-r0","introduced":"0"}],"component":"libxpm","cve_ids":[],"ecosystem":"Alpine","ecosystem_qualifier":"Alpine:v3.19","exploited":false,"fixed_versions":["3.5.15-r0"],"id":"tcs_01M5NEGFD17T58XZMN761PE7CS","modified_at":"2026-10-15T07:17:54.277538134Z","published_at":"2023-02-07T19:15:09.223Z","references":["https://osv.dev/vulnerability/ALPINE-CVE-2022-4883","https://security.alpinelinux.org/vuln/CVE-2022-4883"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"ALPINE-CVE-2022-4883#Alpine:v3.19/libxpm","url":"https://osv.dev/vulnerability/ALPINE-CVE-2022-4883"}],"summary":"A flaw was found in libXpm. When processing files with .Z or .gz extensions, the library calls external programs to compress and uncompress files, relying on the PATH environment variable to find thes"}