Secunia

Two vulnerabilities have been reported in pnmtopng, which can be exploited by malicious people to cause a DoS (Denial of Service) and potentially to compromise a vulnerable system.

1) A boundary error exists when writing RGBA-palette PNG files. This can be exploited to crash pnmtopng and may allow arbitrary code execution via a specially crafted input file with exactly 256 colours.

2) A boundary error exists in "read_text()" when reading the text chunk of an input file. This can be exploited to cause a stack-based buffer overflow when the text chunk exceeds 256 bytes.

Successful exploitation requires that pnmtopng is used with the "-alpha" or the "-text" command line, and e.g. pnmtopng is used in a CGI application that allows remote users to submit image files for processing, or by tricking a user to use pnmtopng with a malicious ".pnm" file.

The vulnerabilities have been reported in versions prior to 2.39.

Note: Several potential malloc allocation overflow bugs have also been fixed.

Solution
Update to version 2.39.
Further details available in Customer Area

Provided and/or discovered by
Reported by vendor.

Changelog
Further details available in Customer Area

Original Advisory
http://sourceforge.net/project/shownotes.php?release_id=370545

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area