-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDKSA-2005:217 http://www.mandriva.com/security/ _______________________________________________________________________ Package : netpbm Date : November 30, 2005 Affected: 10.1, Corporate 2.1, Corporate 3.0 _______________________________________________________________________ Problem Description: Greg Roelofs discovered and fixed several buffer overflows in pnmtopng which is also included in netpbm, a collection of graphic conversion utilities, that can lead to the execution of arbitrary code via a specially crafted PNM file. Multiple buffer overflows in pnmtopng in netpbm 10.0 and earlier allow attackers to execute arbitrary code via a crafted PNM file. (CVE-2005-3632) An off-by-one buffer overflow in pnmtopng, when using the -alpha command line option, allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PNM file with exactly 256 colors. (CVE-2005-3662) The updated packages have been patched to correct this problem. _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3632 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3662 _______________________________________________________________________ Updated Packages: Mandriva Linux 10.1: 550eae5a55b39101687b7a0532219627 10.1/RPMS/libnetpbm9-9.24-8.2.101mdk.i586.rpm b3b2ea4437130703b68a5b3868eaec0b 10.1/RPMS/libnetpbm9-devel-9.24-8.2.101mdk.i586.rpm 653e84715019165ea620d64e5969714f 10.1/RPMS/libnetpbm9-static-devel-9.24-8.2.101mdk.i586.rpm ac1db50f9caf2731a0dbc63e55688ef9 10.1/RPMS/netpbm-9.24-8.2.101mdk.i586.rpm c0b1026156fd6376adba353b4f5d0528 10.1/SRPMS/netpbm-9.24-8.2.101mdk.src.rpm Mandriva Linux 10.1/X86_64: a4fb05222ac3917637ae6a0773f7cdc9 x86_64/10.1/RPMS/lib64netpbm9-9.24-8.2.101mdk.x86_64.rpm 32951fca67c13886bdb779de08f8edf3 x86_64/10.1/RPMS/lib64netpbm9-devel-9.24-8.2.101mdk.x86_64.rpm dafac5b2622f774bc311ef6004e4fa3e x86_64/10.1/RPMS/lib64netpbm9-static-devel-9.24-8.2.101mdk.x86_64.rpm 6984338299c35aca2489b8dae94e9e65 x86_64/10.1/RPMS/netpbm-9.24-8.2.101mdk.x86_64.rpm c0b1026156fd6376adba353b4f5d0528 x86_64/10.1/SRPMS/netpbm-9.24-8.2.101mdk.src.rpm Corporate Server 2.1: cfeeabb6edac6d7234f6e09beb19ff36 corporate/2.1/RPMS/libnetpbm9-9.24-4.5.C21mdk.i586.rpm 4b34fb42803f511646d0129d7fc7dd2f corporate/2.1/RPMS/libnetpbm9-devel-9.24-4.5.C21mdk.i586.rpm 89b46b4d6a89797916ee54a48a38a732 corporate/2.1/RPMS/libnetpbm9-static-devel-9.24-4.5.C21mdk.i586.rpm c4af1176267c16480c3d15f24dcb5db9 corporate/2.1/RPMS/netpbm-9.24-4.5.C21mdk.i586.rpm 0bf9af1326905eb13fb3f4fb66424653 corporate/2.1/SRPMS/netpbm-9.24-4.5.C21mdk.src.rpm Corporate Server 2.1/X86_64: 27b0f5ef22581bc5c5c23bf880302c58 x86_64/corporate/2.1/RPMS/libnetpbm9-9.24-4.5.C21mdk.x86_64.rpm 1743d3247a1e3de046fbf31ce37e443d x86_64/corporate/2.1/RPMS/libnetpbm9-devel-9.24-4.5.C21mdk.x86_64.rpm 4e67e3d7940f30c3bc86cf5a2f215543 x86_64/corporate/2.1/RPMS/libnetpbm9-static-devel-9.24-4.5.C21mdk.x86_64.rpm 7ab637139c9b1977923cae04dd3cc9de x86_64/corporate/2.1/RPMS/netpbm-9.24-4.5.C21mdk.x86_64.rpm 0bf9af1326905eb13fb3f4fb66424653 x86_64/corporate/2.1/SRPMS/netpbm-9.24-4.5.C21mdk.src.rpm Corporate 3.0: 784b993f4e0409fe5255c3228c72ea3b corporate/3.0/RPMS/libnetpbm9-9.24-8.3.C30mdk.i586.rpm 319272b7f74900cabd06c6fa5e0b52b2 corporate/3.0/RPMS/libnetpbm9-devel-9.24-8.3.C30mdk.i586.rpm e6feb19b8b2c0ac6d522c1a73035811d corporate/3.0/RPMS/libnetpbm9-static-devel-9.24-8.3.C30mdk.i586.rpm 42406aa8e04afd173d2194b50d11ca13 corporate/3.0/RPMS/netpbm-9.24-8.3.C30mdk.i586.rpm 17a729bc07c296f77efb87301d122aa6 corporate/3.0/SRPMS/netpbm-9.24-8.3.C30mdk.src.rpm Corporate 3.0/X86_64: d0f1d6da66166acfc0ce18dfd55548e1 x86_64/corporate/3.0/RPMS/lib64netpbm9-9.24-8.3.C30mdk.x86_64.rpm 9e5d975423d7d00a1cfc5b1ea87c07c4 x86_64/corporate/3.0/RPMS/lib64netpbm9-devel-9.24-8.3.C30mdk.x86_64.rpm f3f7f6ec681c2edbf29e789e1f9e1887 x86_64/corporate/3.0/RPMS/lib64netpbm9-static-devel-9.24-8.3.C30mdk.x86_64.rpm 5f27304b1b68639211c34e573c163b52 x86_64/corporate/3.0/RPMS/netpbm-9.24-8.3.C30mdk.x86_64.rpm 17a729bc07c296f77efb87301d122aa6 x86_64/corporate/3.0/SRPMS/netpbm-9.24-8.3.C30mdk.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/security/advisories If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) iD8DBQFDjd9jmqjQ0CJFipgRAt4IAKCNp6xNOrPYD0iIxwaeULBFseKjxQCglNPW poN0qS1nZtou9Y6VRFkumYA= =PJfB -----END PGP SIGNATURE-----
