Bug 174474 - CAN-2005-2978 NetPBM PNMToPNG Buffer Overflow
CAN-2005-2978 NetPBM PNMToPNG Buffer Overflow
Status: CLOSED WONTFIX
Product: Fedora Legacy
Classification: Retired
Component: netpbm (Show other bugs)
rhl7.3
i386 Linux
medium Severity medium
: ---
: ---
Assigned To: Fedora Legacy Bugs
http://www.securityfocus.com/bid/15128
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2005-11-29 08:57 EST by John Dalbec
Modified: 2007-08-30 15:57 EDT (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2007-08-30 15:57:25 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description John Dalbec 2005-11-29 08:57:45 EST
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.5) Gecko/20051012 Netscape/8.0.4

Description of problem:
05.42.11 CVE: CAN-2005-2978
Platform: Unix
Title: NetPBM PNMToPNG Buffer Overflow
Description: Netpbm is a collection of utilities for the manipulation
of graphic images. One of the utilities is PNMToPNG, which converts
PNM images to PNG images. It is reported to be vulnerable to a buffer
overflow issue due to improper boundary checks. PNMToPNG version 10.0
of NetPBM is reported to be vulnerable.
Ref: http://www.securityfocus.com/bid/15128 

Version-Release number of selected component (if applicable):


How reproducible:
Didn't try


Additional info:
Comment 1 John Dalbec 2005-12-07 16:19:12 EST
    * 05.48.18 - CVE: CVE-2005-3632
    * Platform: Cross Platform
    * Title: NetPBM pnmtopng Long Text Line Buffer Overflow
    * Description: NetPBM is a collection of utilities for the manipulation of
graphic images. One of the utilities is pnmtopng, which converts PNM images to
PNG images. pnmtopng is susceptible to buffer overflow issues due to a failure
of the application to properly bounds check user-supplied data prior to copying
it to an insufficiently sized memory buffer. NetPBM versions 9.20 and 10.0 are
affected.
    * Ref: http://www.securityfocus.com/bid/15514 
Comment 2 David Eisenstein 2005-12-20 21:25:21 EST
Red Hat today issued security advisory:
    [RHSA-2005:843-01] Moderate: netpbm security update
for RHEL 2.1 and RHEL 3.
CVE Names:         CVE-2005-3632 CVE-2005-3662

"This update has been rated as having moderate security impact by the Red
Hat Security Response Team." ...

"The netpbm package contains a library of functions that support programs
for handling various graphics file formats.

"A stack based buffer overflow bug was found in the way netpbm converts
Portable Anymap (PNM) files into Portable Network Graphics (PNG). A
specially crafted PNM file could allow an attacker to execute arbitrary
code by attempting to convert a PNM file to a PNG file when using pnmtopng
with the '-text' option. The Common Vulnerabilities and Exposures project
has assigned the name CVE-2005-3632 to this issue.

"An 'off by one' bug was found in the way netpbm converts Portable Anymap
(PNM) files into Portable Network Graphics (PNG). If a victim attempts to
convert a specially crafted 256 color PNM file to a PNG file, then it can
cause the pnmtopng utility to crash. The Common Vulnerabilities and
Exposures project has assigned the name CVE-2005-3662 to this issue."

More info available at:
<http://www.redhat.com/archives/enterprise-watch-list/2005-December/msg00003.html>
Comment 3 Jesse Keating 2007-08-30 15:57:25 EDT
Fedora Legacy project has ended.  These will not be fixed by Fedora Legacy.

Note You need to log in before you can comment on or make changes to this bug.