A vulnerability in Netpbm could result in execution of arbitrary code or Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/netpbm | * | < 10.49.00 | >= 10.49.00 |
Netpbm is a toolkit for manipulation of graphic images, including conversion of images between a variety of different formats.
A stack-based buffer overflow exists in converter/ppm/xpmtoppm.c in Netpbm.
A remote attacker could entice a user to open a specially crafted XMP file using Netpbm, possibly resulting in execution of arbitrary code with the privileges of the process, or a Denial of Service condition.
There is no known workaround at this time.
All Netpbm users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/netpbm-10.49.00"
Packages which depend on this library may need to be recompiled. Tools such as revdep-rebuild may assist in identifying some of these packages.
The pnmtopng utility, part of the Netpbm tools, contains a vulnerability which can potentially result in the execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/netpbm | * | < 10.29 | >= 10.29, >= 10.26.32 (revision), >= 10.26.33 (revision), >= 10.26.42 (revision), >= 10.26.43 (revision), >= 10.26.44 (revision), >= 10.26.48 (revision), >= 10.26.49 (revision), >= 10.26.52 (revision), >= 10.26.53 (revision), >= 10.26.59 (revision), >= 10.26.61 (revision) |
Netpbm is a package of 220 graphics programs and a programming library, including pnmtopng, a tool to convert PNM image files to the PNG format.
RedHat reported that pnmtopng is vulnerable to a buffer overflow.
An attacker could craft a malicious PNM file and entice a user to run pnmtopng on it, potentially resulting in the execution of arbitrary code with the permissions of the user running pnmtopng.
There is no known workaround at this time.
All Netpbm users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose media-libs/netpbm
The pstopnm utility, part of the Netpbm tools, contains a vulnerability which can potentially result in the execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/netpbm | * | < 10.28 | >= 10.28, >= 10.26.32 (revision), >= 10.26.33 (revision), >= 10.26.42 (revision), >= 10.26.43 (revision), >= 10.26.44 (revision), >= 10.26.48 (revision), >= 10.26.49 (revision), >= 10.26.59 (revision), >= 10.26.61 (revision) |
Netpbm is a package of 220 graphics programs and a programming libraries, including pstopnm. pstopnm is a tool which converts PostScript files to PNM image files.
Max Vozeler reported that pstopnm calls the GhostScript interpreter on untrusted PostScript files without specifying the -dSAFER option, to convert a PostScript file into a PBM, PGM, or PNM file.
An attacker could craft a malicious PostScript file and entice a user to run pstopnm on it, resulting in the execution of arbitrary commands with the permissions of the user running pstopnm.
There is no known workaround at this time.
All Netpbm users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose media-libs/netpbm
Utilities included in old Netpbm versions are vulnerable to multiple temporary files issues, potentially allowing a local attacker to overwrite files with the rights of the user running the utility.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/netpbm | * | <= 9.12-r4 | >= 10.0 |
Netpbm is a toolkit containing more than 200 separate utilities for manipulation and conversion of graphic images.
Utilities contained in the Netpbm package prior to the 9.25 version contain defects in temporary file handling. They create temporary files with predictable names without checking first that the target file doesn't already exist.
A local attacker could create symbolic links in the temporary files directory, pointing to a valid file somewhere on the filesystem. When a user or a tool calls one of the affected utilities, this would result in file overwriting with the rights of the user running the utility.
There is no known workaround at this time.
All Netpbm users should upgrade to an unaffected version:
# emerge sync # emerge -pv ">=media-libs/netpbm-10.0" # emerge ">=media-libs/netpbm-10.0"