Stack-based buffer overflow in XPM reader (CVE-2009-4274)

Debian Bug report logs - #569060
Stack-based buffer overflow in XPM reader (CVE-2009-4274)

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Florian Weimer <fw@deneb.enyo.de>

To: submit@bugs.debian.org

Subject: Stack-based buffer overflow in XPM reader (CVE-2009-4274)

Date: Tue, 09 Feb 2010 20:31:04 +0100

Package: netpbm
Version: 2:10.0-12

A vulnerability in the XPM reader has been discovered:

http://netpbm.svn.sourceforge.net/viewvc/netpbm/stable/converter/ppm/xpmtoppm.c?view=patch&r1=995&r2=1076&pathrev=1076

https://bugzilla.redhat.com/show_bug.cgi?id=546580

This should be fixed for (old)stable, perhaps via s-p-u.

Message #14 received at 569060@bugs.debian.org (full text, mbox, reply):

From: Giuseppe Iuculano <giuseppe@iuculano.it>

To: 569060@bugs.debian.org

Subject: debdiff

Date: Fri, 02 Apr 2010 18:31:08 +0200

[Message part 1 (text/plain, inline)]

Hi,

attached is the debdiff I used for DSA and DTSA

Cheers,
Giuseppe.

[netpbm-free-10.0-12.1+squeeze1-nmu.diff (text/x-patch, attachment)]

[signature.asc (application/pgp-signature, attachment)]

Message #19 received at 569060-close@bugs.debian.org (full text, mbox, reply):

From: Giuseppe Iuculano <iuculano@debian.org>

To: 569060-close@bugs.debian.org

Subject: Bug#569060: fixed in netpbm-free 2:10.0-12.1+squeeze1

Date: Sat, 03 Apr 2010 17:49:43 +0000

Source: netpbm-free
Source-Version: 2:10.0-12.1+squeeze1

We believe that the bug you reported is fixed in the latest version of
netpbm-free, which is due to be installed in the Debian FTP archive:

libnetpbm10-dev_10.0-12.1+squeeze1_i386.deb
  to main/n/netpbm-free/libnetpbm10-dev_10.0-12.1+squeeze1_i386.deb
libnetpbm10_10.0-12.1+squeeze1_i386.deb
  to main/n/netpbm-free/libnetpbm10_10.0-12.1+squeeze1_i386.deb
libnetpbm9-dev_10.0-12.1+squeeze1_i386.deb
  to main/n/netpbm-free/libnetpbm9-dev_10.0-12.1+squeeze1_i386.deb
libnetpbm9_10.0-12.1+squeeze1_i386.deb
  to main/n/netpbm-free/libnetpbm9_10.0-12.1+squeeze1_i386.deb
netpbm-free_10.0-12.1+squeeze1.diff.gz
  to main/n/netpbm-free/netpbm-free_10.0-12.1+squeeze1.diff.gz
netpbm-free_10.0-12.1+squeeze1.dsc
  to main/n/netpbm-free/netpbm-free_10.0-12.1+squeeze1.dsc
netpbm_10.0-12.1+squeeze1_i386.deb
  to main/n/netpbm-free/netpbm_10.0-12.1+squeeze1_i386.deb



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 569060@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Giuseppe Iuculano <iuculano@debian.org> (supplier of updated netpbm-free package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.8
Date: Fri, 02 Apr 2010 11:27:22 +0200
Source: netpbm-free
Binary: netpbm libnetpbm10 libnetpbm10-dev libnetpbm9 libnetpbm9-dev
Architecture: source i386
Version: 2:10.0-12.1+squeeze1
Distribution: testing-security
Urgency: high
Maintainer: Andreas Barth <aba@not.so.argh.org>
Changed-By: Giuseppe Iuculano <iuculano@debian.org>
Description: 
 libnetpbm10 - Graphics conversion tools shared libraries
 libnetpbm10-dev - Graphics conversion tools development libraries and header files
 libnetpbm9 - Shared libraries for netpbm (v9)
 libnetpbm9-dev - Development libraries and header files (v9)
 netpbm     - Graphics conversion tools between image formats
Closes: 569060
Changes: 
 netpbm-free (2:10.0-12.1+squeeze1) testing-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * Fixed CVE-2009-4274: Stack-based buffer overflow by processing X PixMap
     image header fields (Closes: #569060)
Checksums-Sha1: 
 3d12ab2cb4fb0b7a33b030155ae3dac2590ca2e9 1359 netpbm-free_10.0-12.1+squeeze1.dsc
 296ad9224a84cb3d2ea8ae338117d12977144daf 53796 netpbm-free_10.0-12.1+squeeze1.diff.gz
 650b4758299d30091d64da23dee58eb47bd49a9b 1254700 netpbm_10.0-12.1+squeeze1_i386.deb
 52d17507eb7eedfcc4464eb1b43b641b3658f3ab 66926 libnetpbm10_10.0-12.1+squeeze1_i386.deb
 22222b4eec1b95ea868a8d1abde4ec7c7ec80652 113602 libnetpbm10-dev_10.0-12.1+squeeze1_i386.deb
 c22837e6b8f2ba5f848bcf8b842e29e93fffb3c6 72260 libnetpbm9_10.0-12.1+squeeze1_i386.deb
 2bdd5ff9c231e24ebc131c79a47c7dc521e97e3e 113492 libnetpbm9-dev_10.0-12.1+squeeze1_i386.deb
Checksums-Sha256: 
 5fe9113e97abe5456448a9ad9e950dc23b316a43ed1e7b51acbe873cbd70b9af 1359 netpbm-free_10.0-12.1+squeeze1.dsc
 4b555842c4a9a1adc45390198bdb8d4c690d983182c17811c2bfdcc5151d6080 53796 netpbm-free_10.0-12.1+squeeze1.diff.gz
 01bad19417613acce1184e9a5c2ee3ebd32898d8ee562cb71f7316dea9a59fc3 1254700 netpbm_10.0-12.1+squeeze1_i386.deb
 a9a540450ac892223194ffba27045d360343d0ddd12225bcca37e8c41790c69a 66926 libnetpbm10_10.0-12.1+squeeze1_i386.deb
 aed50f3975523ff860fd29c3ea96ffb44a65449f3a746ebd430e46d10bb862f2 113602 libnetpbm10-dev_10.0-12.1+squeeze1_i386.deb
 decccac63d37a76aa86d157e4d59ad51e712ba39cee647cb966dc668c76cf261 72260 libnetpbm9_10.0-12.1+squeeze1_i386.deb
 9b70e32ee91fd075af4cbc39d638e41d0d78747e155ca49da08e95a7a152fdbb 113492 libnetpbm9-dev_10.0-12.1+squeeze1_i386.deb
Files: 
 375f2e230ed3411672b0474cc9c7a7d2 1359 graphics optional netpbm-free_10.0-12.1+squeeze1.dsc
 1934b3cb676142ca2aee996904e0dc5b 53796 graphics optional netpbm-free_10.0-12.1+squeeze1.diff.gz
 2adde2b89765a3eb9ed9530c66964e25 1254700 graphics optional netpbm_10.0-12.1+squeeze1_i386.deb
 afddb374c7e9392d85406aa135641fcb 66926 libs optional libnetpbm10_10.0-12.1+squeeze1_i386.deb
 a2b8f8af6ee17b00564fd990e2196c17 113602 libdevel optional libnetpbm10-dev_10.0-12.1+squeeze1_i386.deb
 06ffc6598845e38918d164cff7a9ff68 72260 libs optional libnetpbm9_10.0-12.1+squeeze1_i386.deb
 b9ad8e6a8f81c412d05c42793fbc0c3e 113492 libdevel optional libnetpbm9-dev_10.0-12.1+squeeze1_i386.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iEYEARECAAYFAku1vDQACgkQNxpp46476apavQCgm1NI97hRvRplC79vv+3MsJqw
5FoAnRq1INg54AdKEhoG3gnFq8EV/PMA
=YkaJ
-----END PGP SIGNATURE-----

Message #24 received at 569060-close@bugs.debian.org (full text, mbox, reply):

From: Giuseppe Iuculano <iuculano@debian.org>

To: 569060-close@bugs.debian.org

Subject: Bug#569060: fixed in netpbm-free 2:10.0-12+lenny1

Date: Sat, 17 Apr 2010 14:01:57 +0000

Source: netpbm-free
Source-Version: 2:10.0-12+lenny1

We believe that the bug you reported is fixed in the latest version of
netpbm-free, which is due to be installed in the Debian FTP archive:

libnetpbm10-dev_10.0-12+lenny1_i386.deb
  to main/n/netpbm-free/libnetpbm10-dev_10.0-12+lenny1_i386.deb
libnetpbm10_10.0-12+lenny1_i386.deb
  to main/n/netpbm-free/libnetpbm10_10.0-12+lenny1_i386.deb
libnetpbm9-dev_10.0-12+lenny1_i386.deb
  to main/n/netpbm-free/libnetpbm9-dev_10.0-12+lenny1_i386.deb
libnetpbm9_10.0-12+lenny1_i386.deb
  to main/n/netpbm-free/libnetpbm9_10.0-12+lenny1_i386.deb
netpbm-free_10.0-12+lenny1.diff.gz
  to main/n/netpbm-free/netpbm-free_10.0-12+lenny1.diff.gz
netpbm-free_10.0-12+lenny1.dsc
  to main/n/netpbm-free/netpbm-free_10.0-12+lenny1.dsc
netpbm_10.0-12+lenny1_i386.deb
  to main/n/netpbm-free/netpbm_10.0-12+lenny1_i386.deb



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 569060@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Giuseppe Iuculano <iuculano@debian.org> (supplier of updated netpbm-free package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.8
Date: Sat, 27 Mar 2010 16:44:19 +0100
Source: netpbm-free
Binary: netpbm libnetpbm10 libnetpbm10-dev libnetpbm9 libnetpbm9-dev
Architecture: source i386
Version: 2:10.0-12+lenny1
Distribution: stable-security
Urgency: high
Maintainer: Andreas Barth <aba@not.so.argh.org>
Changed-By: Giuseppe Iuculano <iuculano@debian.org>
Description: 
 libnetpbm10 - Shared libraries for netpbm
 libnetpbm10-dev - Development libraries and header files
 libnetpbm9 - Shared libraries for netpbm
 libnetpbm9-dev - Development libraries and header files
 netpbm     - Graphics conversion tools
Closes: 569060
Changes: 
 netpbm-free (2:10.0-12+lenny1) stable-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * Fixed CVE-2009-4274: Stack-based buffer overflow by processing X PixMap
     image header fields (Closes: #569060)
Checksums-Sha1: 
 d6e5aac667b5ae00d063c89a9137d36535e589df 1170 netpbm-free_10.0-12+lenny1.dsc
 e0ae76a825d3de0480e3f25d2a055bb3b9b2abec 50581 netpbm-free_10.0-12+lenny1.diff.gz
 2bcb554432da7978d8809dd1d07263278f188304 1232756 netpbm_10.0-12+lenny1_i386.deb
 13293a987dceb8a8230b37331f1a890d8fda9fdf 65948 libnetpbm10_10.0-12+lenny1_i386.deb
 671c6094326d334857f451e9934a743b354c3b78 112684 libnetpbm10-dev_10.0-12+lenny1_i386.deb
 b2dbee47af38c0eb9569f797eb7de3126702179b 71320 libnetpbm9_10.0-12+lenny1_i386.deb
 18424bd2744352582d15c256ed20ae082c784227 112556 libnetpbm9-dev_10.0-12+lenny1_i386.deb
Checksums-Sha256: 
 3540ac3c1fbc9b16e42d435e58bca4226688924465a301c41d04c52f1bb35d15 1170 netpbm-free_10.0-12+lenny1.dsc
 066099f06a17d21ecd715149883402482a385653c00cd3c97058c0e4e4052c90 50581 netpbm-free_10.0-12+lenny1.diff.gz
 9cc430085810818f98808ddc808fc89f97842f65effe24acb2f16d73e036b70f 1232756 netpbm_10.0-12+lenny1_i386.deb
 b2b80ab877e4c9adb2f0c4d967cf5459de48374c881f1cd4b342723a79276a5a 65948 libnetpbm10_10.0-12+lenny1_i386.deb
 f33f7019f60ab4b7f805306303c3d512dfb810a9deb46767cc5d73ba7f61d50b 112684 libnetpbm10-dev_10.0-12+lenny1_i386.deb
 6e48093506905ba718b80732927a650d21cb15771e3f8c278f7d47df26f1b3e5 71320 libnetpbm9_10.0-12+lenny1_i386.deb
 37c56116a32f231769462cb5695658a4987ce93ea3b7786f5d9058403f092797 112556 libnetpbm9-dev_10.0-12+lenny1_i386.deb
Files: 
 fa9aeb6e0fea3225fd5052b0ec0367a1 1170 graphics optional netpbm-free_10.0-12+lenny1.dsc
 1c11ea48609ce48dd8033e076d5600a4 50581 graphics optional netpbm-free_10.0-12+lenny1.diff.gz
 4cdd10ae0b4fc3c29b8e48b22db4b2ab 1232756 graphics optional netpbm_10.0-12+lenny1_i386.deb
 2bd2b8060fa1ad585f40c2b523e26ef2 65948 libs optional libnetpbm10_10.0-12+lenny1_i386.deb
 0c1eba758b1e845e998ec05dd2a20184 112684 libdevel optional libnetpbm10-dev_10.0-12+lenny1_i386.deb
 cd5419ceca00a00137544292cc81e65d 71320 libs optional libnetpbm9_10.0-12+lenny1_i386.deb
 415cddd4ba07fa6c2d88728c6aa771ab 112556 libdevel optional libnetpbm9-dev_10.0-12+lenny1_i386.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iEYEARECAAYFAkuvK6EACgkQNxpp46476aq+GQCeOLJo7AaMTuucUGQKuN/lOFZH
AeYAn0K7DIw36AALO/yzkEfY6KI4dgf1
=IvkR
-----END PGP SIGNATURE-----

Message #29 received at 569060@bugs.debian.org (full text, mbox, reply):

From: Nico Golde <nion@debian.org>

To: 569060@bugs.debian.org

Subject: intent to NMU

Date: Sun, 20 Jun 2010 14:31:21 +0200

[Message part 1 (text/plain, inline)]

Hi,
I intent to upload a 0day NMU to fix this issue. A debdiff is located at:
http://people.debian.org/~nion/nmu-diff/netpbm-free-10.0-12.1_10.0-12.2.patch

Cheers
Nico

-- 
Nico Golde - http://www.ngolde.de - nion@jabber.ccc.de - GPG: 0xA0A0AAAA
For security reasons, all text in this mail is double-rot13 encrypted.

[Message part 2 (application/pgp-signature, inline)]

Message #34 received at 569060@bugs.debian.org (full text, mbox, reply):

From: Andreas Barth <aba@not.so.argh.org>

To: Nico Golde <nion@debian.org>, 569060@bugs.debian.org

Subject: Re: Bug#569060: intent to NMU

Date: Sun, 20 Jun 2010 14:52:31 +0200

* Nico Golde (nion@debian.org) [100620 14:33]:
> I intent to upload a 0day NMU to fix this issue. A debdiff is located at:
> http://people.debian.org/~nion/nmu-diff/netpbm-free-10.0-12.1_10.0-12.2.patch

Just upload - as long as you don't bring non-DFSG code in (like
pulling from upstream), or anything similar, just upload whatever
seems sensible.


Andi

Message #39 received at 569060-close@bugs.debian.org (full text, mbox, reply):

From: Nico Golde <nion@debian.org>

To: 569060-close@bugs.debian.org

Subject: Bug#569060: fixed in netpbm-free 2:10.0-12.2

Date: Sun, 20 Jun 2010 13:05:23 +0000

Source: netpbm-free
Source-Version: 2:10.0-12.2

We believe that the bug you reported is fixed in the latest version of
netpbm-free, which is due to be installed in the Debian FTP archive:

libnetpbm10-dev_10.0-12.2_amd64.deb
  to main/n/netpbm-free/libnetpbm10-dev_10.0-12.2_amd64.deb
libnetpbm10_10.0-12.2_amd64.deb
  to main/n/netpbm-free/libnetpbm10_10.0-12.2_amd64.deb
libnetpbm9-dev_10.0-12.2_amd64.deb
  to main/n/netpbm-free/libnetpbm9-dev_10.0-12.2_amd64.deb
libnetpbm9_10.0-12.2_amd64.deb
  to main/n/netpbm-free/libnetpbm9_10.0-12.2_amd64.deb
netpbm-free_10.0-12.2.diff.gz
  to main/n/netpbm-free/netpbm-free_10.0-12.2.diff.gz
netpbm-free_10.0-12.2.dsc
  to main/n/netpbm-free/netpbm-free_10.0-12.2.dsc
netpbm_10.0-12.2_amd64.deb
  to main/n/netpbm-free/netpbm_10.0-12.2_amd64.deb



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 569060@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Nico Golde <nion@debian.org> (supplier of updated netpbm-free package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.8
Date: Sun, 20 Jun 2010 14:27:25 +0200
Source: netpbm-free
Binary: netpbm libnetpbm10 libnetpbm10-dev libnetpbm9 libnetpbm9-dev
Architecture: source amd64
Version: 2:10.0-12.2
Distribution: unstable
Urgency: high
Maintainer: Andreas Barth <aba@not.so.argh.org>
Changed-By: Nico Golde <nion@debian.org>
Description: 
 libnetpbm10 - Graphics conversion tools shared libraries
 libnetpbm10-dev - Graphics conversion tools development libraries and header files
 libnetpbm9 - Shared libraries for netpbm (v9)
 libnetpbm9-dev - Development libraries and header files (v9)
 netpbm     - Graphics conversion tools between image formats
Closes: 569060
Changes: 
 netpbm-free (2:10.0-12.2) unstable; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * Fix stack-based buffer overflow when processing XPM
     image header fields. This can result in the execution
     of arbitrary code (CVE-2009-4274; Closes: #569060)
Checksums-Sha1: 
 0d0ba511e14a1df06d72478241e4e3c089476d2b 1323 netpbm-free_10.0-12.2.dsc
 2a2c2ecab3d8395ea186be07f3632bfafb9431ad 53748 netpbm-free_10.0-12.2.diff.gz
 2d58d14d9970ed473da5e9818aaa227a4957f9a3 1351558 netpbm_10.0-12.2_amd64.deb
 6da92cecd1908f9fdcbc890a6e5a40ab486e6024 93230 libnetpbm10_10.0-12.2_amd64.deb
 44dd013d52390aafe44db970c791fe08ed96a9ee 144438 libnetpbm10-dev_10.0-12.2_amd64.deb
 ef566ae039540f40957a7caaa59dd90ffd2be1a1 102276 libnetpbm9_10.0-12.2_amd64.deb
 add685296516524e683b5ee458d220006fbe6d11 145110 libnetpbm9-dev_10.0-12.2_amd64.deb
Checksums-Sha256: 
 5002611baf6d235daa4c60ae811f00b8bce9b634cf11ec1b2987f958052900fc 1323 netpbm-free_10.0-12.2.dsc
 c27f7749646b3014ea864ee1e5f8f27bb640d60b4599e44e6295ce5b879d5967 53748 netpbm-free_10.0-12.2.diff.gz
 2f0f33429f6eff4310c0e2078f09f64a233b25a1b1214140b138e12575f19d3c 1351558 netpbm_10.0-12.2_amd64.deb
 0c6ff79cc4cfcdcedbe7c472d75a3d3d70e440ffc8378a167cc9d8a0d440ffb6 93230 libnetpbm10_10.0-12.2_amd64.deb
 7f8bc4ec4efbbe5de7124b85d8b2e8e064f750019f3c9f50fd466d403991a610 144438 libnetpbm10-dev_10.0-12.2_amd64.deb
 e6693f67b03d23d5ad94dcefb51eb5ed7e4372316fcb3c60cda28012f5e250ef 102276 libnetpbm9_10.0-12.2_amd64.deb
 ef59ccb4dbd0b5227f910baf7287aeb10debed2fbc2fcf98f9f52e6506476069 145110 libnetpbm9-dev_10.0-12.2_amd64.deb
Files: 
 e3f273522cb048db36671e267c6d74fb 1323 graphics optional netpbm-free_10.0-12.2.dsc
 a557272863cca93146993c03f1786c6b 53748 graphics optional netpbm-free_10.0-12.2.diff.gz
 8df5209254733683e107458bcb47e97b 1351558 graphics optional netpbm_10.0-12.2_amd64.deb
 076a35938af6e5e1b5bc19ac2eebb2a5 93230 libs optional libnetpbm10_10.0-12.2_amd64.deb
 3548e4dddf643e0204b9371796c2476f 144438 libdevel optional libnetpbm10-dev_10.0-12.2_amd64.deb
 1f3c7ba0281586435d2940948a9b864c 102276 libs optional libnetpbm9_10.0-12.2_amd64.deb
 96179dbbad66496fbea5bb9c8926233f 145110 libdevel optional libnetpbm9-dev_10.0-12.2_amd64.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iEYEARECAAYFAkweDLUACgkQHYflSXNkfP/xBQCdE/8d38ORjU9OmvX4QdkhylWz
GWgAniuG/gPEsiLtdd0o1AQCuo6Cm1Cy
=rvLa
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.