CVE-2008-0554: Buffer Overflow
Buffer overflow in the readImageData function in giftopnm.c in netpbm before 10.27 in netpbm before 10.27 allows remote user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted GIF image, a similar issue to CVE-2006-4484.
Other sources
GIF handling code used in netpbm's giftopnm converter is based on the same code as used by gd and SDLimage and is affected by the overflow known as CVE-2006-4484 and CVE-2007-6697.
readImageData function in giftopnm.c does not properly check the value of lzwMinCodeSize value read from GIF image before passing it to lzwInit, which uses it as upper bound during the initialization of fixed sized table array, leading to a buffer overflow.
This issue was fixed in upstream version 10.27. Code checking the value is in the initial giftopnm.c revision in projects public SVN repository:
http://netpbm.svn.sourceforge.net/viewvc/netpbm/trunk/converter/other/giftopnm.c?revision=1&view=markup#l1052
This issue does not affect netpbm packages as shipped in Red Hat Enterprise Linux 5 and current versions of Fedora, as those packages are based on fixed upstream version.
Related issues: CVE-2006-4484 (gd), CVE-2007-6697 (SDLimage), CVE-2008-0553 (tk)
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2008-0554?
CVE-2008-0554 is considered to have a high severity due to its potential to cause a denial of service and execute arbitrary code.
How do I fix CVE-2008-0554?
To fix CVE-2008-0554, upgrade netpbm to version 10.27 or later to patch the buffer overflow vulnerability.
What type of vulnerability is CVE-2008-0554?
CVE-2008-0554 is a buffer overflow vulnerability that affects the readImageData function in netpbm.
Who is affected by CVE-2008-0554?
Users of netpbm versions prior to 10.27 who process crafted GIF images are affected by CVE-2008-0554.
Can CVE-2008-0554 be exploited remotely?
CVE-2008-0554 can be exploited by remote user-assisted attackers through specially crafted GIF images.