From Bugzilla Helper: User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.5) Gecko/20051012 Netscape/8.0.4 Description of problem: 05.42.11 CVE: CAN-2005-2978 Platform: Unix Title: NetPBM PNMToPNG Buffer Overflow Description: Netpbm is a collection of utilities for the manipulation of graphic images. One of the utilities is PNMToPNG, which converts PNM images to PNG images. It is reported to be vulnerable to a buffer overflow issue due to improper boundary checks. PNMToPNG version 10.0 of NetPBM is reported to be vulnerable. Ref: http://www.securityfocus.com/bid/15128 Version-Release number of selected component (if applicable): How reproducible: Didn't try Additional info:
* 05.48.18 - CVE: CVE-2005-3632 * Platform: Cross Platform * Title: NetPBM pnmtopng Long Text Line Buffer Overflow * Description: NetPBM is a collection of utilities for the manipulation of graphic images. One of the utilities is pnmtopng, which converts PNM images to PNG images. pnmtopng is susceptible to buffer overflow issues due to a failure of the application to properly bounds check user-supplied data prior to copying it to an insufficiently sized memory buffer. NetPBM versions 9.20 and 10.0 are affected. * Ref: http://www.securityfocus.com/bid/15514
Red Hat today issued security advisory: [RHSA-2005:843-01] Moderate: netpbm security update for RHEL 2.1 and RHEL 3. CVE Names: CVE-2005-3632 CVE-2005-3662 "This update has been rated as having moderate security impact by the Red Hat Security Response Team." ... "The netpbm package contains a library of functions that support programs for handling various graphics file formats. "A stack based buffer overflow bug was found in the way netpbm converts Portable Anymap (PNM) files into Portable Network Graphics (PNG). A specially crafted PNM file could allow an attacker to execute arbitrary code by attempting to convert a PNM file to a PNG file when using pnmtopng with the '-text' option. The Common Vulnerabilities and Exposures project has assigned the name CVE-2005-3632 to this issue. "An 'off by one' bug was found in the way netpbm converts Portable Anymap (PNM) files into Portable Network Graphics (PNG). If a victim attempts to convert a specially crafted 256 color PNM file to a PNG file, then it can cause the pnmtopng utility to crash. The Common Vulnerabilities and Exposures project has assigned the name CVE-2005-3662 to this issue." More info available at: <http://www.redhat.com/archives/enterprise-watch-list/2005-December/msg00003.html>
Fedora Legacy project has ended. These will not be fixed by Fedora Legacy.