CVE-2005-2978
Summary
| CVE | CVE-2005-2978 |
|---|---|
| State | PUBLISHED |
| Assigner | redhat |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2005-10-18 22:02:00 UTC |
| Updated | 2025-04-03 01:03:51 UTC |
| Description | pnmtopng in netpbm before 10.25, when using the -trans option, uses uninitialized size and index variables when converting Portable Anymap (PNM) images to Portable Network Graphics (PNG), which might allow attackers to execute arbitrary code by modifying the stack. |
Risk And Classification
Primary CVSS: v2.0 7.5 from [email protected]
AV:N/AC:L/Au:N/C:P/I:P/A:P
Problem Types: NVD-CWE-Other | n/a
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
LowAuthentication
NoneConfidentiality
PartialIntegrity
PartialAvailability
PartialAV:N/AC:L/Au:N/C:P/I:P/A:P
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Netpbm | Netpbm | 10.0 | All | All | All |
| Application | Netpbm | Netpbm | 10.1 | All | All | All |
| Application | Netpbm | Netpbm | 10.10 | All | All | All |
| Application | Netpbm | Netpbm | 10.11 | All | All | All |
| Application | Netpbm | Netpbm | 10.12 | All | All | All |
| Application | Netpbm | Netpbm | 10.13 | All | All | All |
| Application | Netpbm | Netpbm | 10.14 | All | All | All |
| Application | Netpbm | Netpbm | 10.15 | All | All | All |
| Application | Netpbm | Netpbm | 10.16 | All | All | All |
| Application | Netpbm | Netpbm | 10.17 | All | All | All |
| Application | Netpbm | Netpbm | 10.18 | All | All | All |
| Application | Netpbm | Netpbm | 10.19 | All | All | All |
| Application | Netpbm | Netpbm | 10.2 | All | All | All |
| Application | Netpbm | Netpbm | 10.20 | All | All | All |
| Application | Netpbm | Netpbm | 10.21 | All | All | All |
| Application | Netpbm | Netpbm | 10.22 | All | All | All |
| Application | Netpbm | Netpbm | 10.23 | All | All | All |
| Application | Netpbm | Netpbm | 10.24 | All | All | All |
| Application | Netpbm | Netpbm | 10.3 | All | All | All |
| Application | Netpbm | Netpbm | 10.4 | All | All | All |
| Application | Netpbm | Netpbm | 10.5 | All | All | All |
| Application | Netpbm | Netpbm | 10.6 | All | All | All |
| Application | Netpbm | Netpbm | 10.7 | All | All | All |
| Application | Netpbm | Netpbm | 10.8 | All | All | All |
| Application | Netpbm | Netpbm | 10.9 | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Secunia - Advisories - Ubuntu update for netpbm | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Debian -- Security Information -- DSA-878-1 netpbm-free | af854a3a-2127-422b-91ae-364da2661108 | www.debian.org | |
| Webmail - OVH | af854a3a-2127-422b-91ae-364da2661108 | www.vupen.com | |
| USN-210-1: netpbm vulnerability | Ubuntu security notices | af854a3a-2127-422b-91ae-364da2661108 | usn.ubuntu.com | |
| SecurityTracker.com Archives - Netpbm Buffer Overflow in 'pnmtopng' May Let Remote Users Execute Arbitrary Code | af854a3a-2127-422b-91ae-364da2661108 | securitytracker.com | |
| Secunia - Advisories - SUSE Updates for Multiple Packages | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Secunia - Advisories - Gentoo update for netpbm | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Secunia - Advisories - NetPBM "pnmtopng" Stack Corruption Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| 168278 – CAN-2005-2978 Crash running pnmtopng -trans on some pnm files | af854a3a-2127-422b-91ae-364da2661108 | bugzilla.redhat.com | Exploit, Vendor Advisory |
| rhn.redhat.com | Red Hat Support | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | Vendor Advisory |
| Security Announcement | af854a3a-2127-422b-91ae-364da2661108 | www.novell.com | |
| NetPBM PNMToPNG Buffer Overflow Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| Repository / Oval Repository | af854a3a-2127-422b-91ae-364da2661108 | oval.cisecurity.org | |
| Gentoo Linux Documentation -- Netpbm: Buffer overflow in pnmtopng | af854a3a-2127-422b-91ae-364da2661108 | www.gentoo.org | |
| Secunia - Advisories - Debian update for netpbm-free | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Secunia - Advisories - Red Hat update for netpbm | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.