Executive Summary
| Summary | |
|---|---|
| Title | netpbm vulnerability |
| Informations | |||
|---|---|---|---|
| Name | USN-210-1 | First vendor Publication | 2005-10-18 |
| Vendor | Ubuntu | Last vendor Modification | 2005-10-18 |
| Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 7.5 | Attack Range | Network |
| Cvss Impact Score | 6.4 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| A security issue affects the following Ubuntu releases: Ubuntu 4.10 (Warty Warthog) Ubuntu 5.04 (Hoary Hedgehog) Ubuntu 5.10 (Breezy Badger) The following packages are affected: netpbm The problem can be corrected by upgrading the affected package to version 2:10.0-5ubuntu0.2 (for Ubuntu 4.10), 2:10.0-8ubuntu0.2 (for Ubuntu 5.04), or 2:10.0-8ubuntu1.1 (for Ubuntu 5.10). In general, a standard system upgrade is sufficient to effect the necessary changes. Details follow: A buffer overflow was found in the "pnmtopng" conversion program. By tricking an user (or automated system) to process a specially crafted PNM image with pnmtopng, this could be exploited to execute arbitrary code with the privileges of the user running pnmtopng. |
Original Source
| Url : http://www.ubuntu.com/usn/USN-210-1 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:10135 | |||
| Oval ID: | oval:org.mitre.oval:def:10135 | ||
| Title: | pnmtopng in netpbm before 10.25, when using the -trans option, uses uninitialized size and index variables when converting Portable Anymap (PNM) images to Portable Network Graphics (PNG), which might allow attackers to execute arbitrary code by modifying the stack. | ||
| Description: | pnmtopng in netpbm before 10.25, when using the -trans option, uses uninitialized size and index variables when converting Portable Anymap (PNM) images to Portable Network Graphics (PNG), which might allow attackers to execute arbitrary code by modifying the stack. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2005-2978 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 | Product(s): | |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2009-10-10 | Name : SLES9: Security update for netpbm File : nvt/sles9p5010678.nasl |
| 2008-09-24 | Name : Gentoo Security Advisory GLSA 200510-18 (Netpbm) File : nvt/glsa_200510_18.nasl |
| 2008-09-04 | Name : FreeBSD Ports: netpbm File : nvt/freebsd_netpbm.nasl |
| 2008-01-17 | Name : Debian Security Advisory DSA 878-1 (netpbm-free) File : nvt/deb_878_1.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 20068 | Netpbm pnmtopng closestColorInPalette() Function Arbitrary Code Execution |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2006-10-14 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-878.nasl - Type : ACT_GATHER_INFO |
| 2006-07-05 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2005-793.nasl - Type : ACT_GATHER_INFO |
| 2006-05-13 | Name : The remote FreeBSD host is missing a security-related update. File : freebsd_pkg_ae9fb0d7c4dc11dab2fb000e0c2e438a.nasl - Type : ACT_GATHER_INFO |
| 2006-01-15 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2005-199.nasl - Type : ACT_GATHER_INFO |
| 2006-01-15 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-210-1.nasl - Type : ACT_GATHER_INFO |
| 2005-10-24 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200510-18.nasl - Type : ACT_GATHER_INFO |
| 2005-10-19 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2005-793.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 12:03:05 |
|
