Heap-based Buffer Over-read Vulnerability in Netpbm
CVE-2018-8975

5.5MEDIUM

Key Information:

Vendor

Netpbm Project

Status
Netpbm
Vendor
CVE Published:
25 March 2018

What is CVE-2018-8975?

A vulnerability exists in the pm_mallocarray2 function within lib/util/mallocvar.c of Netpbm versions prior to 10.81.03. This flaw permits remote attackers to trigger a denial of service by supplying a specially crafted image file, which leads to a heap-based buffer over-read. The risk associated with this vulnerability can result in unexpected behaviors in applications utilizing the affected Netpbm library. Developers and users of the library should take immediate action to evaluate their systems and apply necessary patches.

References

https://github.com/xiaoqx/pocs/blob/master/netpbm
x_refsource_MISC
http://lists.opensuse.org/opensuse-security-announce/2019...
vendor-advisoryx_refsource_SUSE
https://lists.fedoraproject.org/archives/list/package-ann...
vendor-advisoryx_refsource_FEDORA

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.