Description
pstopnm in netpbm does not properly use the "-dSAFER" option when calling Ghostscript to convert a PostScript file into a (1) PBM, (2) PGM, or (3) PNM file, which allows external user-assisted attackers to execute arbitrary commands.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | netpbm-free | 2:10.0-9 | — |
| Debian 13 | netpbm-free | 2:10.0-9 | — |
| Debian 12 | netpbm-free | 2:10.0-9 | — |
| Debian 3.1 | netpbm-free | 2:10.0-8sarge3 | DSA-1021-1 |
| Debian 3.0 | netpbm-free | 2:9.20-8.6 | DSA-1021-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | netpbm +2 | 10.25-2.EL4.1 | RHSA-2005:743 |
| RHEL 3 | netpbm +2 | 9.24-11.30.2 | RHSA-2005:743 |
Advisories 2
- RHSA-2005:743 Red Hat Security Advisory: netpbm security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1021-1 netpbm-free - insecure program execution Debian Security (DSA / DLA) · Mar 9, 2026
References
- netpbm-dsafer-command-execution(21500) vdb-entry
- 14379 vdb-entry
- SUSE-SR:2005:019 vendor-advisory
- oval:org.mitre.oval:def:11645 vdb-entry signature
- 2005-0038 vendor-advisory
- DSA-1021 vendor-advisory
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=319757
- 18330 third-party-advisory
- 1014752 vdb-entry
- 19436 third-party-advisory
- 16184 third-party-advisory
- RHSA-2005:743 vendor-advisory
- 18253 vdb-entry