Description
pnmtopng in netpbm before 10.25, when using the -trans option, uses uninitialized size and index variables when converting Portable Anymap (PNM) images to Portable Network Graphics (PNG), which might allow attackers to execute arbitrary code by modifying the stack.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | netpbm-free | 2:10.0-10 | — |
| Debian 13 | netpbm-free | 2:10.0-10 | — |
| Debian 12 | netpbm-free | 2:10.0-10 | — |
| Debian 3.1 | netpbm-free | 2:10.0-8sarge1 | DSA-878-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | netpbm +2 | 10.25-2.EL4.2 | RHSA-2005:793 |
Advisories 2
- RHSA-2005:793 Red Hat Security Advisory: netpbm security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-878-1 netpbm-free - buffer overflow Debian Security (DSA / DLA) · Mar 9, 2026
References
- USN-210-1 vendor-advisory
- 1015071 vdb-entry
- ADV-2005-2133 vdb-entry
- 17282 third-party-advisory
- DSA-878 vendor-advisory
- 17221 third-party-advisory
- 17357 third-party-advisory
- RHSA-2005:793 vendor-advisory
- 17256 third-party-advisory
- https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=168278
- 17265 third-party-advisory
- 17222 third-party-advisory
- SUSE-SR:2005:024 vendor-advisory
- GLSA-200510-18 vendor-advisory
- 15128 vdb-entry
- oval:org.mitre.oval:def:10135 vdb-entry signature