Netpbm before 10.86.51, 11.02.29, and 11.15.07 sgitopnm Heap Buffer Overflow

Summary

Netpbm before 10.86.51, 11.x before 11.02.29, and 11.03 before 11.15.07 contains a heap-based buffer overflow in sgitopnm's readChannels() function when processing RLE-compressed SGI images. Attackers can supply crafted SGI files with oversized offset table lengths to write controlled data past the heap buffer, causing crashes or potential code execution.

Remediation

1. Inventory every Netpbm Netpbm deployment, including staging.
2. Upgrade Netpbm Netpbm to the fixed version for your release line, listed under Affected versions.
3. Confirm the running version after the upgrade.

References

• Patchhttps://sourceforge.net/p/netpbm/code/5317/
• Advisoryhttps://www.vulncheck.com/advisories/netpbm-before-10.86.51-11.02.29-and-11.15.07-sgitopnm-heap-buffer-overflow
• Referencehttps://svn.code.sf.net/p/netpbm/code/!svn/bc/5316/trunk/converter/other/sgitopnm.c
• Referencehttps://svn.code.sf.net/p/netpbm/code/!svn/bc/5318/advanced/doc/HISTORY
• Referencehttps://svn.code.sf.net/p/netpbm/code/!svn/bc/5319/stable/doc/HISTORY
• Referencehttps://svn.code.sf.net/p/netpbm/code/!svn/bc/5371/super_stable/doc/HISTORY