Bug 174474

Summary:	CAN-2005-2978 NetPBM PNMToPNG Buffer Overflow
Product:	[Retired] Fedora Legacy	Reporter:	John Dalbec <jpdalbec>
Component:	netpbm	Assignee:	Fedora Legacy Bugs <bugs>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	rhl7.3	CC:	deisenst
Target Milestone:	---
Target Release:	---
Hardware:	i386
OS:	Linux
URL:	http://www.securityfocus.com/bid/15128
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2007-08-30 19:57:25 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description John Dalbec 2005-11-29 13:57:45 UTC

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.5) Gecko/20051012 Netscape/8.0.4

Description of problem:
05.42.11 CVE: CAN-2005-2978
Platform: Unix
Title: NetPBM PNMToPNG Buffer Overflow
Description: Netpbm is a collection of utilities for the manipulation
of graphic images. One of the utilities is PNMToPNG, which converts
PNM images to PNG images. It is reported to be vulnerable to a buffer
overflow issue due to improper boundary checks. PNMToPNG version 10.0
of NetPBM is reported to be vulnerable.
Ref: http://www.securityfocus.com/bid/15128 

Version-Release number of selected component (if applicable):


How reproducible:
Didn't try


Additional info:

Comment 1 John Dalbec 2005-12-07 21:19:12 UTC

    * 05.48.18 - CVE: CVE-2005-3632
    * Platform: Cross Platform
    * Title: NetPBM pnmtopng Long Text Line Buffer Overflow
    * Description: NetPBM is a collection of utilities for the manipulation of
graphic images. One of the utilities is pnmtopng, which converts PNM images to
PNG images. pnmtopng is susceptible to buffer overflow issues due to a failure
of the application to properly bounds check user-supplied data prior to copying
it to an insufficiently sized memory buffer. NetPBM versions 9.20 and 10.0 are
affected.
    * Ref: http://www.securityfocus.com/bid/15514

Comment 2 David Eisenstein 2005-12-21 02:25:21 UTC

Red Hat today issued security advisory:
    [RHSA-2005:843-01] Moderate: netpbm security update
for RHEL 2.1 and RHEL 3.
CVE Names:         CVE-2005-3632 CVE-2005-3662

"This update has been rated as having moderate security impact by the Red
Hat Security Response Team." ...

"The netpbm package contains a library of functions that support programs
for handling various graphics file formats.

"A stack based buffer overflow bug was found in the way netpbm converts
Portable Anymap (PNM) files into Portable Network Graphics (PNG). A
specially crafted PNM file could allow an attacker to execute arbitrary
code by attempting to convert a PNM file to a PNG file when using pnmtopng
with the '-text' option. The Common Vulnerabilities and Exposures project
has assigned the name CVE-2005-3632 to this issue.

"An 'off by one' bug was found in the way netpbm converts Portable Anymap
(PNM) files into Portable Network Graphics (PNG). If a victim attempts to
convert a specially crafted 256 color PNM file to a PNG file, then it can
cause the pnmtopng utility to crash. The Common Vulnerabilities and
Exposures project has assigned the name CVE-2005-3662 to this issue."

More info available at:
<http://www.redhat.com/archives/enterprise-watch-list/2005-December/msg00003.html>

Comment 3 Jesse Keating 2007-08-30 19:57:25 UTC

Fedora Legacy project has ended.  These will not be fixed by Fedora Legacy.