RHEL 2.1 / 3 / 4 : netpbm (RHSA-2005:743)

high Nessus Plugin ID 19488

Synopsis

The remote Red Hat host is missing one or more security updates.

Description

Updated netpbm packages that fix a security issue are now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

The netpbm package contains a library of functions that support programs for handling various graphics file formats, including .pbm (portable bitmaps), .pgm (portable graymaps), .pnm (portable anymaps), .ppm (portable pixmaps) and others.

A bug was found in the way netpbm converts PostScript files into PBM, PGM or PPM files. An attacker could create a carefully crafted PostScript file in such a way that it could execute arbitrary commands when the file is processed by a victim using pstopnm. The Common Vulnerabilities and Exposures project assigned the name CVE-2005-2471 to this issue.

All users of netpbm should upgrade to the updated packages, which contain a backported patch to resolve this issue.

Solution

Update the affected netpbm, netpbm-devel and / or netpbm-progs packages.

See Also

https://access.redhat.com/security/cve/cve-2005-2471

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=319757

https://access.redhat.com/errata/RHSA-2005:743

Plugin Details

Severity: High

ID: 19488

File Name: redhat-RHSA-2005-743.nasl

Version: 1.26

Type: local

Agent: unix

Published: 8/23/2005

Updated: 1/14/2021

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.5

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: p-cpe:/a:redhat:enterprise_linux:netpbm, p-cpe:/a:redhat:enterprise_linux:netpbm-devel, p-cpe:/a:redhat:enterprise_linux:netpbm-progs, cpe:/o:redhat:enterprise_linux:2.1, cpe:/o:redhat:enterprise_linux:3, cpe:/o:redhat:enterprise_linux:4

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu

Exploit Ease: No known exploits are available

Patch Publication Date: 8/22/2005

Vulnerability Publication Date: 8/5/2005

Reference Information

CVE: CVE-2005-2471

BID: 14379, 15128

RHSA: 2005:743