[ MDVSA-2010:039 ] netpbm

[dude67]

_______________________________________________________________________

Package : netpbm
Date : February 17, 2010
Affected: 2008.0, 2009.0, 2009.1, 2010.0, Corporate 4.0,
Enterprise Server 5.0
_______________________________________________________________________

Problem Description:

A vulnerability have been discovered and corrected in netpbm:

Stack-based buffer overflow in converter/ppm/xpmtoppm.c in netpbm
before 10.47.07 allows context-dependent attackers to cause a denial
of service (application crash) or possibly execute arbitrary code
via an XPM image file that contains a crafted header field associated
with a large color index value (CVE-2009-4274).

Packages for 2008.0 are provided for Corporate Desktop 2008.0
customers.

The updated packages have been patched to correct this issue.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cg ... -2009-4274
_______________________________________________________________________