Secunia

Bastien Nocera has reported a vulnerability in NetPBM, which potentially can be exploited by malicious people to cause a DoS (Denial of Service) or compromise a user's system.

The vulnerability is caused due to the use of uninitialised variables by "pnmtopng" in the "closestColorInPalette()" function. This may be exploited to cause stack corruption and may allow arbitrary code execution when processing a malicious ".pnm" file.

The vulnerability has been reported in version 10.25. Other versions may also be affected.

Solution
Only use pnmtopng on trusted files.

Provided and/or discovered by
Bastien Nocera

Original Advisory
Red Hat:
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=168278

Deep Links
Links available in Customer Area