Netpbm before 10.86.51, 11.02.30, and 11.15.08 picttoppm Stack Buffer Overflow via paintPoly

Summary

Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a stack-based buffer overflow in the picttoppm paintPoly() function due to an unbounded polygon point count. Attackers can supply a crafted PICT file with a polygon exceeding 100 points to overwrite the fixed pts array, causing crashes or potentially code execution.

Remediation

1. Inventory every Netpbm Netpbm deployment, including staging.
2. Upgrade Netpbm Netpbm to the fixed version for your release line, listed under Affected versions.
3. Confirm the running version after the upgrade.

References

• Patchhttps://sourceforge.net/p/netpbm/code/5328/
• Advisoryhttps://www.vulncheck.com/advisories/netpbm-before-10.86.51-11.02.30-and-11.15.08-picttoppm-stack-buffer-overflow-via-paintpoly
• Referencehttps://svn.code.sf.net/p/netpbm/code/!svn/bc/5327/trunk/converter/ppm/picttoppm.c
• Referencehttps://svn.code.sf.net/p/netpbm/code/!svn/bc/5357/advanced/doc/HISTORY
• Referencehttps://svn.code.sf.net/p/netpbm/code/!svn/bc/5358/stable/doc/HISTORY
• Referencehttps://svn.code.sf.net/p/netpbm/code/!svn/bc/5371/super_stable/doc/HISTORY