Netpbm before 10.86.51, 11.02.30, and 11.15.08 Heap Overflow in xpmtoppm

Summary

Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a heap buffer overflow in xpmtoppm caused by an unvalidated characters-per-pixel value in the XPM header. Attackers can supply a crafted XPM file with characters-per-pixel greater than 3 to overrun fixed 3-byte colorName hash entries, causing crashes or potentially code execution.

Remediation

1. Inventory every Netpbm Netpbm deployment, including staging.
2. Upgrade Netpbm Netpbm to the fixed version for your release line, listed under Affected versions.
3. Confirm the running version after the upgrade.

References

• Patchhttps://sourceforge.net/p/netpbm/code/5336/
• Advisoryhttps://www.vulncheck.com/advisories/netpbm-before-10.86.51-11.02.30-and-11.15.08-heap-overflow-in-xpmtoppm
• Referencehttps://svn.code.sf.net/p/netpbm/code/!svn/bc/5335/trunk/converter/ppm/xpmtoppm.c
• Referencehttps://svn.code.sf.net/p/netpbm/code/!svn/bc/5357/advanced/doc/HISTORY
• Referencehttps://svn.code.sf.net/p/netpbm/code/!svn/bc/5358/stable/doc/HISTORY
• Referencehttps://svn.code.sf.net/p/netpbm/code/!svn/bc/5371/super_stable/doc/HISTORY