-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDVSA-2010:039 http://www.mandriva.com/security/ _______________________________________________________________________ Package : netpbm Date : February 17, 2010 Affected: 2008.0, 2009.0, 2009.1, 2010.0, Corporate 4.0, Enterprise Server 5.0 _______________________________________________________________________ Problem Description: A vulnerability have been discovered and corrected in netpbm: Stack-based buffer overflow in converter/ppm/xpmtoppm.c in netpbm before 10.47.07 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an XPM image file that contains a crafted header field associated with a large color index value (CVE-2009-4274). Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers. The updated packages have been patched to correct this issue. _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4274 _______________________________________________________________________ Updated Packages: Mandriva Linux 2008.0: 8bcad87072eb2e7bc56fb0dd5b85259a 2008.0/i586/libnetpbm10-10.34-8.4mdv2008.0.i586.rpm 59ed2a66a9b7ba7892e8eca4fb13881c 2008.0/i586/libnetpbm-devel-10.34-8.4mdv2008.0.i586.rpm 531166ffe9840c4acc26df23709e22fd 2008.0/i586/libnetpbm-static-devel-10.34-8.4mdv2008.0.i586.rpm 2a84ec450978bf42f52a5e769c1cae9d 2008.0/i586/netpbm-10.34-8.4mdv2008.0.i586.rpm 575de6109fea969f98e92e94b042dda0 2008.0/SRPMS/netpbm-10.34-8.4mdv2008.0.src.rpm Mandriva Linux 2008.0/X86_64: 290a4caf55e0363712b56c275ba04ce0 2008.0/x86_64/lib64netpbm10-10.34-8.4mdv2008.0.x86_64.rpm f6ae08756eaa4dce2627a85085e17b46 2008.0/x86_64/lib64netpbm-devel-10.34-8.4mdv2008.0.x86_64.rpm 2b49a1468231d86ad516b747af7984c2 2008.0/x86_64/lib64netpbm-static-devel-10.34-8.4mdv2008.0.x86_64.rpm e866478a921c955840a333ecf80ac46c 2008.0/x86_64/netpbm-10.34-8.4mdv2008.0.x86_64.rpm 575de6109fea969f98e92e94b042dda0 2008.0/SRPMS/netpbm-10.34-8.4mdv2008.0.src.rpm Mandriva Linux 2009.0: ee1ea92d859e3e7373775fe5a3a22bbb 2009.0/i586/libnetpbm10-10.35.46-1.2mdv2009.0.i586.rpm ace5a3ba900ad6a557588475e3bef3a8 2009.0/i586/libnetpbm-devel-10.35.46-1.2mdv2009.0.i586.rpm 00b33b00223a2cc933b4c8ec0f0abdb1 2009.0/i586/libnetpbm-static-devel-10.35.46-1.2mdv2009.0.i586.rpm bd9d8c7dbf383bd9784f64557d63b5fc 2009.0/i586/netpbm-10.35.46-1.2mdv2009.0.i586.rpm bfd3a9bc163067b71537abc9d400ff00 2009.0/SRPMS/netpbm-10.35.46-1.2mdv2009.0.src.rpm Mandriva Linux 2009.0/X86_64: f635d7ef616dee3da2a71674daeaaf52 2009.0/x86_64/lib64netpbm10-10.35.46-1.2mdv2009.0.x86_64.rpm 365fe028aa3a53a6bc7929a5bbbef00f 2009.0/x86_64/lib64netpbm-devel-10.35.46-1.2mdv2009.0.x86_64.rpm c3dbd8ad3f9b592e39a8f2141c872a45 2009.0/x86_64/lib64netpbm-static-devel-10.35.46-1.2mdv2009.0.x86_64.rpm e5a66e406c325bfab3be1552d0b07898 2009.0/x86_64/netpbm-10.35.46-1.2mdv2009.0.x86_64.rpm bfd3a9bc163067b71537abc9d400ff00 2009.0/SRPMS/netpbm-10.35.46-1.2mdv2009.0.src.rpm Mandriva Linux 2009.1: 779d04e7a3aaebcad8466198512da832 2009.1/i586/libnetpbm10-10.35.59-1.1mdv2009.1.i586.rpm cab822b6ada4810e636f59fd5f973f89 2009.1/i586/libnetpbm-devel-10.35.59-1.1mdv2009.1.i586.rpm a3368b94646adc06eaf89ce10eb5a2b9 2009.1/i586/libnetpbm-static-devel-10.35.59-1.1mdv2009.1.i586.rpm 93b6279a74590026b1e16ea7473ddb97 2009.1/i586/netpbm-10.35.59-1.1mdv2009.1.i586.rpm 55555730694672069956ccccaa0d890b 2009.1/SRPMS/netpbm-10.35.59-1.1mdv2009.1.src.rpm Mandriva Linux 2009.1/X86_64: 8f412a3a9e0a3655c6431f75d2694ef9 2009.1/x86_64/lib64netpbm10-10.35.59-1.1mdv2009.1.x86_64.rpm 3ff3df2d1bd3ae81be50de6f62c81cf4 2009.1/x86_64/lib64netpbm-devel-10.35.59-1.1mdv2009.1.x86_64.rpm bc23d8105469a7d597b71bf51d49dcb8 2009.1/x86_64/lib64netpbm-static-devel-10.35.59-1.1mdv2009.1.x86_64.rpm 5a5158cf3c372be6c9a0db33e026f1f7 2009.1/x86_64/netpbm-10.35.59-1.1mdv2009.1.x86_64.rpm 55555730694672069956ccccaa0d890b 2009.1/SRPMS/netpbm-10.35.59-1.1mdv2009.1.src.rpm Mandriva Linux 2010.0: 4fa5cc0fd4bc8a7886d33c6ba937e701 2010.0/i586/libnetpbm10-10.35.64-4.1mdv2010.0.i586.rpm aeecf29a8b0ba59493cee20f7057356d 2010.0/i586/libnetpbm-devel-10.35.64-4.1mdv2010.0.i586.rpm e2fa1d2b95b9adeb79bbb3fab08a2b6d 2010.0/i586/libnetpbm-static-devel-10.35.64-4.1mdv2010.0.i586.rpm c11938419e48ae2ac9d237955324e899 2010.0/i586/netpbm-10.35.64-4.1mdv2010.0.i586.rpm efb8bf31dfedfe90726c343daa917e1a 2010.0/SRPMS/netpbm-10.35.64-4.1mdv2010.0.src.rpm Mandriva Linux 2010.0/X86_64: 7d1d1796786b7001c3120fdbd39c6ce2 2010.0/x86_64/lib64netpbm10-10.35.64-4.1mdv2010.0.x86_64.rpm 5c36756ee54b446e5769490f38d9c7a9 2010.0/x86_64/lib64netpbm-devel-10.35.64-4.1mdv2010.0.x86_64.rpm d87677cb5902e4b770da31d09d5074ee 2010.0/x86_64/lib64netpbm-static-devel-10.35.64-4.1mdv2010.0.x86_64.rpm d50867f0735a4dc22292d2e5e86a36fa 2010.0/x86_64/netpbm-10.35.64-4.1mdv2010.0.x86_64.rpm efb8bf31dfedfe90726c343daa917e1a 2010.0/SRPMS/netpbm-10.35.64-4.1mdv2010.0.src.rpm Corporate 4.0: 4ce1174f09ffd1a201d2700d92eb9159 corporate/4.0/i586/libnetpbm10-10.29-1.7.20060mlcs4.i586.rpm 0b23ea99e1ef82b0269b451c8a3c8ca5 corporate/4.0/i586/libnetpbm10-devel-10.29-1.7.20060mlcs4.i586.rpm ed76d9c0709dd4096bb048c606949496 corporate/4.0/i586/libnetpbm10-static-devel-10.29-1.7.20060mlcs4.i586.rpm eb98ce5306a3d4f48f86f9eb0ff651cb corporate/4.0/i586/netpbm-10.29-1.7.20060mlcs4.i586.rpm ca94f75da48df2b08f0738885e699d10 corporate/4.0/SRPMS/netpbm-10.29-1.7.20060mlcs4.src.rpm Corporate 4.0/X86_64: 601edb209c88048519d828436aaa87a4 corporate/4.0/x86_64/lib64netpbm10-10.29-1.7.20060mlcs4.x86_64.rpm b9fa69d18db9736e078a4a37f0e8dd53 corporate/4.0/x86_64/lib64netpbm10-devel-10.29-1.7.20060mlcs4.x86_64.rpm 008db822b44e044cffd17654a931edba corporate/4.0/x86_64/lib64netpbm10-static-devel-10.29-1.7.20060mlcs4.x86_64.rpm 03b9c9b998d779d41d199d4fe4fc7ba3 corporate/4.0/x86_64/netpbm-10.29-1.7.20060mlcs4.x86_64.rpm ca94f75da48df2b08f0738885e699d10 corporate/4.0/SRPMS/netpbm-10.29-1.7.20060mlcs4.src.rpm Mandriva Enterprise Server 5: c63f9537584cf106e536f7d83bc54081 mes5/i586/libnetpbm10-10.35.46-1.2mdvmes5.i586.rpm 986eff41c0358f28b28f611fd249adf3 mes5/i586/libnetpbm-devel-10.35.46-1.2mdvmes5.i586.rpm 816e2b8b6ad495cc614a3e2173121e5c mes5/i586/libnetpbm-static-devel-10.35.46-1.2mdvmes5.i586.rpm 5e45816cc9bec160a2320d303b13f8a6 mes5/i586/netpbm-10.35.46-1.2mdvmes5.i586.rpm 2713691fd47d18d4af1467db4ca7329c mes5/SRPMS/netpbm-10.35.46-1.2mdvmes5.src.rpm Mandriva Enterprise Server 5/X86_64: e3368f94a486303a50f9abce9f7d657a mes5/x86_64/lib64netpbm10-10.35.46-1.2mdvmes5.x86_64.rpm 6f83d0317f9571169c4fe0db914529d9 mes5/x86_64/lib64netpbm-devel-10.35.46-1.2mdvmes5.x86_64.rpm 6c844b6530612960b3bbf1ac0d701faf mes5/x86_64/lib64netpbm-static-devel-10.35.46-1.2mdvmes5.x86_64.rpm 793de9149882fb1cf01733a04fd5e617 mes5/x86_64/netpbm-10.35.46-1.2mdvmes5.x86_64.rpm 2713691fd47d18d4af1467db4ca7329c mes5/SRPMS/netpbm-10.35.46-1.2mdvmes5.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/security/advisories If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iD8DBQFLfAR2mqjQ0CJFipgRAm3UAKDD0sda+6F2DGdFVR1NArF0GU5qCgCgu+ON BjPj/Zm5Th1AhYlHWW7nQfY= =HT3Q -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/