Netpbm
Monthly
Heap buffer overflow in Netpbm's jbigtopnm converter allows a crafted multi-plane JBIG file with large header dimensions to trigger an integer overflow while calculating the output buffer size, after which jbg_dec_merge_planes() overruns the undersized heap allocation, causing crashes or potentially code execution. Affected releases are Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08. The issue is local with user interaction required to process the file, CVSS 4.0 rates it 8.5, no public exploit was identified at time of analysis, and vendor patches are available.
Heap buffer overflow in Netpbm's xpmtoppm converter allows an attacker who supplies a crafted XPM file with a characters-per-pixel value greater than 3 to overwrite fixed 3-byte colorName hash entries, causing crashes or potentially code execution. Affected versions are Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08; the assessed vector is local with no privileges and requires the victim or an automated workflow to run xpmtoppm on the hostile file. No public exploit was identified at time of analysis, and vendor patches are available for all three branches.
Stack-based buffer overflow in Netpbm's picttoppm converter allows a crafted PICT file to overflow the fixed-size coord stack array in scanPoly() once polygon edges produce more than 5000 coordinate points, crashing the converter or potentially allowing code execution in the context of the process that parses the image. The flaw affects Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08, is rated 8.5 under CVSS 4.0 (CWE-121), and is a local-vector issue with passive user interaction because the victim must deliberately run picttoppm on the attacker-supplied file; no public exploit has been identified at time of analysis. The vendor has shipped fixes and the priority decision places remediation in this week, but the exposure is a locally exploitable file-parsing memory-corruption bug rather than a remotely reachable one, since picttoppm is a specific conversion utility rather than a listening service.
Stack-based buffer overflow in Netpbm's picttoppm PICT-to-PPM converter lets an attacker who supplies a crafted PICT file containing a polygon with more than 100 points overwrite the fixed-size pts array in paintPoly(), crashing the converter and potentially achieving code execution in the context of the converting process. Only Netpbm builds before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 are affected, and exploitation requires picttoppm to actually be run on the malicious file (CVSS AV:L with UI:P), so exposure is limited to users and automated image-conversion pipelines that process untrusted PICT input. Vendor fixes are published for all three branches; no public exploit code was identified at time of analysis, and the case is triaged as this_week rather than an emergency.
Heap memory corruption in Netpbm's winicontopam converter affects releases before 10.86.51, 11.02.30, and 11.15.08, where a crafted ICO/CUR file declaring a width or height above 32767 wraps the signed int16_t row/column loop counters negative and drives writes through negative row buffer indices. The assessed vector is local (AV:L) with passive user interaction (UI:P) and no privileges required, so exploitation only occurs when a user, or a server-side or batch pipeline, runs winicontopam on attacker-supplied icon input; the confirmed outcome is a crash, with arbitrary code execution described only as a potential, non-demonstrated consequence. No public exploit code and no confirmed active exploitation were identified at time of analysis, and vendor patches are available in all three maintained branches.
Heap-based buffer overflow in Netpbm's sgitopnm converter affects releases before 10.86.51, 11.x before 11.02.29, and 11.03 before 11.15.07. A local, unauthenticated attacker can trigger it only when a user or automated job runs sgitopnm on a crafted RLE-compressed SGI image with an oversized offset table length, causing a heap write past the buffer that can crash the process and may permit code execution. No public exploit was identified at time of analysis, and the risk is context-dependent rather than an internet-facing emergency.
Out-of-bounds read in Netpbm's tgatoppm converter allows a crafted color-mapped Targa file to crash the tool or leak adjacent memory into the output image. Affected builds are Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08; exploitation is local and requires the victim or an automated workflow to run tgatoppm on the malicious file. No public exploit identified at time of analysis, and a vendor patch is available; this is assessed as a moderate-priority issue, not an emergency.
Heap out-of-bounds read in Netpbm's rasttopnm converter through 11.16.00 can expose up to 255 adjacent heap bytes in generated PNM output, or crash the conversion, when a crafted colormapped Sun rasterfile contains pixel index bytes beyond the supplied palette length. The issue requires a user or automated workflow to feed the malicious rasterfile to rasttopnm, is locally oriented, and does not provide code execution or memory writes. No public exploit or CISA KEV confirmation is available at time of analysis, and the CVSS 4.0 vector indicates no privileges required but user interaction.
Heap-based out-of-bounds write in Netpbm's rasttopnm Sun rasterfile decoder (pr_load_image) allows an unauthenticated local attacker to corrupt memory by supplying a crafted byte-encoded .ras file that declares tiny dimensions but carries an oversized run-length payload. The flaw affects Netpbm through 11.16.00 and is triggered when the victim or an automated pipeline runs rasttopnm on the malicious Sun rasterfile, causing memory corruption, crashes, and possible low-integrity effects. No public exploit code was identified at time of analysis, and the independent assessment rates this as Medium (CVSS 3.1 6.9) because exploitation is local and requires user interaction.
The pm_mallocarray2 function in lib/util/mallocvar.c in Netpbm through 10.81.03 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted image file, as. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
tiffttopnm in netpbm 10.47.63 does not properly use the libtiff TIFFRGBAImageGet function, which allows remote attackers to cause a denial of service (out-of-bounds read and write) via a crafted tiff. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Heap buffer overflow in Netpbm's jbigtopnm converter allows a crafted multi-plane JBIG file with large header dimensions to trigger an integer overflow while calculating the output buffer size, after which jbg_dec_merge_planes() overruns the undersized heap allocation, causing crashes or potentially code execution. Affected releases are Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08. The issue is local with user interaction required to process the file, CVSS 4.0 rates it 8.5, no public exploit was identified at time of analysis, and vendor patches are available.
Heap buffer overflow in Netpbm's xpmtoppm converter allows an attacker who supplies a crafted XPM file with a characters-per-pixel value greater than 3 to overwrite fixed 3-byte colorName hash entries, causing crashes or potentially code execution. Affected versions are Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08; the assessed vector is local with no privileges and requires the victim or an automated workflow to run xpmtoppm on the hostile file. No public exploit was identified at time of analysis, and vendor patches are available for all three branches.
Stack-based buffer overflow in Netpbm's picttoppm converter allows a crafted PICT file to overflow the fixed-size coord stack array in scanPoly() once polygon edges produce more than 5000 coordinate points, crashing the converter or potentially allowing code execution in the context of the process that parses the image. The flaw affects Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08, is rated 8.5 under CVSS 4.0 (CWE-121), and is a local-vector issue with passive user interaction because the victim must deliberately run picttoppm on the attacker-supplied file; no public exploit has been identified at time of analysis. The vendor has shipped fixes and the priority decision places remediation in this week, but the exposure is a locally exploitable file-parsing memory-corruption bug rather than a remotely reachable one, since picttoppm is a specific conversion utility rather than a listening service.
Stack-based buffer overflow in Netpbm's picttoppm PICT-to-PPM converter lets an attacker who supplies a crafted PICT file containing a polygon with more than 100 points overwrite the fixed-size pts array in paintPoly(), crashing the converter and potentially achieving code execution in the context of the converting process. Only Netpbm builds before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 are affected, and exploitation requires picttoppm to actually be run on the malicious file (CVSS AV:L with UI:P), so exposure is limited to users and automated image-conversion pipelines that process untrusted PICT input. Vendor fixes are published for all three branches; no public exploit code was identified at time of analysis, and the case is triaged as this_week rather than an emergency.
Heap memory corruption in Netpbm's winicontopam converter affects releases before 10.86.51, 11.02.30, and 11.15.08, where a crafted ICO/CUR file declaring a width or height above 32767 wraps the signed int16_t row/column loop counters negative and drives writes through negative row buffer indices. The assessed vector is local (AV:L) with passive user interaction (UI:P) and no privileges required, so exploitation only occurs when a user, or a server-side or batch pipeline, runs winicontopam on attacker-supplied icon input; the confirmed outcome is a crash, with arbitrary code execution described only as a potential, non-demonstrated consequence. No public exploit code and no confirmed active exploitation were identified at time of analysis, and vendor patches are available in all three maintained branches.
Heap-based buffer overflow in Netpbm's sgitopnm converter affects releases before 10.86.51, 11.x before 11.02.29, and 11.03 before 11.15.07. A local, unauthenticated attacker can trigger it only when a user or automated job runs sgitopnm on a crafted RLE-compressed SGI image with an oversized offset table length, causing a heap write past the buffer that can crash the process and may permit code execution. No public exploit was identified at time of analysis, and the risk is context-dependent rather than an internet-facing emergency.
Out-of-bounds read in Netpbm's tgatoppm converter allows a crafted color-mapped Targa file to crash the tool or leak adjacent memory into the output image. Affected builds are Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08; exploitation is local and requires the victim or an automated workflow to run tgatoppm on the malicious file. No public exploit identified at time of analysis, and a vendor patch is available; this is assessed as a moderate-priority issue, not an emergency.
Heap out-of-bounds read in Netpbm's rasttopnm converter through 11.16.00 can expose up to 255 adjacent heap bytes in generated PNM output, or crash the conversion, when a crafted colormapped Sun rasterfile contains pixel index bytes beyond the supplied palette length. The issue requires a user or automated workflow to feed the malicious rasterfile to rasttopnm, is locally oriented, and does not provide code execution or memory writes. No public exploit or CISA KEV confirmation is available at time of analysis, and the CVSS 4.0 vector indicates no privileges required but user interaction.
Heap-based out-of-bounds write in Netpbm's rasttopnm Sun rasterfile decoder (pr_load_image) allows an unauthenticated local attacker to corrupt memory by supplying a crafted byte-encoded .ras file that declares tiny dimensions but carries an oversized run-length payload. The flaw affects Netpbm through 11.16.00 and is triggered when the victim or an automated pipeline runs rasttopnm on the malicious Sun rasterfile, causing memory corruption, crashes, and possible low-integrity effects. No public exploit code was identified at time of analysis, and the independent assessment rates this as Medium (CVSS 3.1 6.9) because exploitation is local and requires user interaction.
The pm_mallocarray2 function in lib/util/mallocvar.c in Netpbm through 10.81.03 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted image file, as. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
tiffttopnm in netpbm 10.47.63 does not properly use the libtiff TIFFRGBAImageGet function, which allows remote attackers to cause a denial of service (out-of-bounds read and write) via a crafted tiff. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.