REDHAT-BUG-546580: Buffer Overflow
First published: Fri Dec 11 2009(Updated: )
Marc Schoenefeld found a stack-based buffer overflow in the way netpbm graphics file formats handling library used to process content of header fields of the X PixMap (XPM) image file. A remote attacker could provide a specially-crafted XPM image file and trick the local user into processing it, which would lead to denial of service (crash of application using the netpbm library) or, potentially, to execution of arbitrary code with the privileges of that application.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Netpbm |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=377777&action=diff
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=377777&action=edit
- http://netpbm.svn.sourceforge.net/viewvc/netpbm/stable/converter/ppm/xpmtoppm.c?view=patch&r1=995&r2=1076&pathrev=1076
- https://access.redhat.com/security/cve/CVE-2009-4274
- https://rhn.redhat.com/errata/RHSA-2011-1811.html
- https://bugzilla.redhat.com/show_bug.cgi?id=546580
Frequently Asked Questions
What is the severity of REDHAT-BUG-546580?
The severity of REDHAT-BUG-546580 is critical due to the potential for remote code execution.
How do I fix REDHAT-BUG-546580?
You can fix REDHAT-BUG-546580 by updating to the latest patched version of the Netpbm library.
What causes the vulnerability REDHAT-BUG-546580?
REDHAT-BUG-546580 is caused by a stack-based buffer overflow in the processing of XPM image files.
Who is affected by REDHAT-BUG-546580?
Any user or application using the Netpbm graphics file library is potentially affected by REDHAT-BUG-546580.
Can REDHAT-BUG-546580 be exploited remotely?
Yes, REDHAT-BUG-546580 can be exploited remotely if a user processes a maliciously crafted XPM image.
- agent/references
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2009-4274
- agent/weakness
- agent/severity
- agent/description
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/netpbm
- canonical/netpbm