CVE-2009-4274

Stack-based buffer overflow in converter/ppm/xpmtoppm.c in netpbm before 10.47.07 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an XPM image file that contains a crafted header field associated with a large color index value.
References
Link Resource
http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00004.html
http://netpbm.svn.sourceforge.net/viewvc/netpbm/stable/converter/ppm/xpmtoppm.c?view=patch&r1=995&r2=1076&pathrev=1076
http://netpbm.svn.sourceforge.net/viewvc/netpbm/stable/doc/HISTORY?view=markup
http://secunia.com/advisories/38530
http://secunia.com/advisories/38915
http://www.debian.org/security/2010/dsa-2026
http://www.mandriva.com/security/advisories?name=MDVSA-2010:039
http://www.openwall.com/lists/oss-security/2010/02/09/11
http://www.redhat.com/support/errata/RHSA-2011-1811.html
http://www.securityfocus.com/bid/38164
http://www.vupen.com/english/advisories/2010/0358 Vendor Advisory
http://www.vupen.com/english/advisories/2010/0780
https://bugzilla.redhat.com/show_bug.cgi?id=546580
https://exchange.xforce.ibmcloud.com/vulnerabilities/56207
http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00004.html
http://netpbm.svn.sourceforge.net/viewvc/netpbm/stable/converter/ppm/xpmtoppm.c?view=patch&r1=995&r2=1076&pathrev=1076
http://netpbm.svn.sourceforge.net/viewvc/netpbm/stable/doc/HISTORY?view=markup
http://secunia.com/advisories/38530
http://secunia.com/advisories/38915
http://www.debian.org/security/2010/dsa-2026
http://www.mandriva.com/security/advisories?name=MDVSA-2010:039
http://www.openwall.com/lists/oss-security/2010/02/09/11
http://www.redhat.com/support/errata/RHSA-2011-1811.html
http://www.securityfocus.com/bid/38164
http://www.vupen.com/english/advisories/2010/0358 Vendor Advisory
http://www.vupen.com/english/advisories/2010/0780
https://bugzilla.redhat.com/show_bug.cgi?id=546580
https://exchange.xforce.ibmcloud.com/vulnerabilities/56207
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:netpbm:netpbm:10.0:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.1:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.2:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.3:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.4:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.5:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.6:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.7:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.8:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.9:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.10:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.11:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.12:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.13:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.14:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.15:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.16:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.17:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.18:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.19:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.20:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.21:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.22:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.23:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.24:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.25:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.26:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.27:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.28:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.29:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.30:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.31:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.32:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.33:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.34:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.35.00:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.35.01:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.35.02:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.35.03:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.35.04:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.35.05:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.35.06:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.35.07:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.35.08:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.35.09:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.35.10:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.35.11:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.35.12:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.35.13:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.35.14:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.35.15:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.35.16:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.35.17:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.35.18:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.35.19:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.35.20:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.35.21:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.35.22:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.35.23:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.35.24:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.35.25:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.35.26:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.35.27:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.35.28:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.35.29:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.35.30:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.35.31:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.35.32:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.35.33:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.35.34:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.35.35:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.35.36:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.35.37:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.35.38:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.35.39:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.35.40:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.35.41:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.35.42:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.35.43:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.35.44:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.35.45:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.35.46:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.35.47:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.36.00:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.37.00:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.38.00:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.39.00:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.40.00:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.41.00:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.42.00:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.43.00:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.44.00:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.45.00:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.46.00:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.47.00:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.47.01:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.47.02:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.47.03:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.47.04:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.47.05:*:*:*:*:*:*:*
cpe:2.3:a:netpbm:netpbm:10.47.06:*:*:*:*:*:*:*

History

21 Nov 2024, 01:09

Type Values Removed Values Added
References () http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00004.html - () http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00004.html -
References () http://netpbm.svn.sourceforge.net/viewvc/netpbm/stable/converter/ppm/xpmtoppm.c?view=patch&r1=995&r2=1076&pathrev=1076 - () http://netpbm.svn.sourceforge.net/viewvc/netpbm/stable/converter/ppm/xpmtoppm.c?view=patch&r1=995&r2=1076&pathrev=1076 -
References () http://netpbm.svn.sourceforge.net/viewvc/netpbm/stable/doc/HISTORY?view=markup - () http://netpbm.svn.sourceforge.net/viewvc/netpbm/stable/doc/HISTORY?view=markup -
References () http://secunia.com/advisories/38530 - () http://secunia.com/advisories/38530 -
References () http://secunia.com/advisories/38915 - () http://secunia.com/advisories/38915 -
References () http://www.debian.org/security/2010/dsa-2026 - () http://www.debian.org/security/2010/dsa-2026 -
References () http://www.mandriva.com/security/advisories?name=MDVSA-2010:039 - () http://www.mandriva.com/security/advisories?name=MDVSA-2010:039 -
References () http://www.openwall.com/lists/oss-security/2010/02/09/11 - () http://www.openwall.com/lists/oss-security/2010/02/09/11 -
References () http://www.redhat.com/support/errata/RHSA-2011-1811.html - () http://www.redhat.com/support/errata/RHSA-2011-1811.html -
References () http://www.securityfocus.com/bid/38164 - () http://www.securityfocus.com/bid/38164 -
References () http://www.vupen.com/english/advisories/2010/0358 - Vendor Advisory () http://www.vupen.com/english/advisories/2010/0358 - Vendor Advisory
References () http://www.vupen.com/english/advisories/2010/0780 - () http://www.vupen.com/english/advisories/2010/0780 -
References () https://bugzilla.redhat.com/show_bug.cgi?id=546580 - () https://bugzilla.redhat.com/show_bug.cgi?id=546580 -
References () https://exchange.xforce.ibmcloud.com/vulnerabilities/56207 - () https://exchange.xforce.ibmcloud.com/vulnerabilities/56207 -

Information

Published : 2010-02-12 21:30

Updated : 2024-11-21 01:09


NVD link : CVE-2009-4274

Mitre link : CVE-2009-4274

CVE.ORG link : CVE-2009-4274


JSON object : View

Products Affected

netpbm

  • netpbm
CWE
CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer