Issued:
2005-08-22
Updated:
2005-08-22

RHSA-2005:743 - Security Advisory

Synopsis

netpbm security update

Type/Severity

Security Advisory: Low

Topic

Updated netpbm packages that fix a security issue are now available.

This update has been rated as having low security impact by the Red Hat
Security Response Team.

Description

The netpbm package contains a library of functions that support
programs for handling various graphics file formats, including .pbm
(portable bitmaps), .pgm (portable graymaps), .pnm (portable anymaps),
.ppm (portable pixmaps) and others.

A bug was found in the way netpbm converts PostScript files into PBM, PGM
or PPM files. An attacker could create a carefully crafted PostScript file
in such a way that it could execute arbitrary commands when the
file is processed by a victim using pstopnm. The Common Vulnerabilities
and Exposures project assigned the name CAN-2005-2471 to this issue.

All users of netpbm should upgrade to the updated packages, which
contain a backported patch to resolve this issue.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via Red Hat Network. To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

Affected Products

  • Red Hat Enterprise Linux Server 4 x86_64
  • Red Hat Enterprise Linux Server 4 ia64
  • Red Hat Enterprise Linux Server 4 i386
  • Red Hat Enterprise Linux Server 3 x86_64
  • Red Hat Enterprise Linux Server 3 ia64
  • Red Hat Enterprise Linux Server 3 i386
  • Red Hat Enterprise Linux Server 2 ia64
  • Red Hat Enterprise Linux Server 2 i386
  • Red Hat Enterprise Linux Workstation 4 x86_64
  • Red Hat Enterprise Linux Workstation 4 ia64
  • Red Hat Enterprise Linux Workstation 4 i386
  • Red Hat Enterprise Linux Workstation 3 x86_64
  • Red Hat Enterprise Linux Workstation 3 ia64
  • Red Hat Enterprise Linux Workstation 3 i386
  • Red Hat Enterprise Linux Workstation 2 ia64
  • Red Hat Enterprise Linux Workstation 2 i386
  • Red Hat Enterprise Linux Desktop 4 x86_64
  • Red Hat Enterprise Linux Desktop 4 i386
  • Red Hat Enterprise Linux Desktop 3 x86_64
  • Red Hat Enterprise Linux Desktop 3 i386
  • Red Hat Enterprise Linux for IBM z Systems 4 s390x
  • Red Hat Enterprise Linux for IBM z Systems 4 s390
  • Red Hat Enterprise Linux for IBM z Systems 3 s390x
  • Red Hat Enterprise Linux for IBM z Systems 3 s390
  • Red Hat Enterprise Linux for Power, big endian 4 ppc
  • Red Hat Enterprise Linux for Power, big endian 3 ppc

Fixes

  • BZ - 165354 - CAN-2005-2471 netpbm should use the -dSAFER option when calling Ghostscript

CVEs

References

Red Hat Enterprise Linux Server 4

SRPM
x86_64
netpbm-10.25-2.EL4.1.i386.rpm SHA-256: f21046a6766451d7e2dfc7bdfadedd4ca436350c55ad6964bb186d0d5fc3f870
netpbm-10.25-2.EL4.1.i386.rpm SHA-256: f21046a6766451d7e2dfc7bdfadedd4ca436350c55ad6964bb186d0d5fc3f870
netpbm-10.25-2.EL4.1.x86_64.rpm SHA-256: 311259f8b454091e05da8a18f6e642bd735235bb443b9cbb73607119ce9ba427
netpbm-10.25-2.EL4.1.x86_64.rpm SHA-256: 311259f8b454091e05da8a18f6e642bd735235bb443b9cbb73607119ce9ba427
netpbm-devel-10.25-2.EL4.1.x86_64.rpm SHA-256: edfcf86aba0c9e3fcdcc069103edbcf75786be328123cda632430a14c63816c4
netpbm-devel-10.25-2.EL4.1.x86_64.rpm SHA-256: edfcf86aba0c9e3fcdcc069103edbcf75786be328123cda632430a14c63816c4
netpbm-progs-10.25-2.EL4.1.x86_64.rpm SHA-256: 504fbb901f766a9eeb8e24bc45d9e3e18475c7878c100c6f5e5622e296dc80b7
netpbm-progs-10.25-2.EL4.1.x86_64.rpm SHA-256: 504fbb901f766a9eeb8e24bc45d9e3e18475c7878c100c6f5e5622e296dc80b7
ia64
netpbm-10.25-2.EL4.1.i386.rpm SHA-256: f21046a6766451d7e2dfc7bdfadedd4ca436350c55ad6964bb186d0d5fc3f870
netpbm-10.25-2.EL4.1.i386.rpm SHA-256: f21046a6766451d7e2dfc7bdfadedd4ca436350c55ad6964bb186d0d5fc3f870
netpbm-10.25-2.EL4.1.ia64.rpm SHA-256: 946b29d1416a593d693fe3ed4ad80e54c89dafcfb02e2b4cd3ec32ddc1f68666
netpbm-10.25-2.EL4.1.ia64.rpm SHA-256: 946b29d1416a593d693fe3ed4ad80e54c89dafcfb02e2b4cd3ec32ddc1f68666
netpbm-devel-10.25-2.EL4.1.ia64.rpm SHA-256: 108ffbc5b1f35750d5c78efefd181c6e00dcb0f8f9b0bdd51887cd0ac088d81e
netpbm-devel-10.25-2.EL4.1.ia64.rpm SHA-256: 108ffbc5b1f35750d5c78efefd181c6e00dcb0f8f9b0bdd51887cd0ac088d81e
netpbm-progs-10.25-2.EL4.1.ia64.rpm SHA-256: 8664ae2e6c8623af0d0c69efa97a636a1971a6a12a3ea5300d25e41b6bc36963
netpbm-progs-10.25-2.EL4.1.ia64.rpm SHA-256: 8664ae2e6c8623af0d0c69efa97a636a1971a6a12a3ea5300d25e41b6bc36963
i386
netpbm-10.25-2.EL4.1.i386.rpm SHA-256: f21046a6766451d7e2dfc7bdfadedd4ca436350c55ad6964bb186d0d5fc3f870
netpbm-10.25-2.EL4.1.i386.rpm SHA-256: f21046a6766451d7e2dfc7bdfadedd4ca436350c55ad6964bb186d0d5fc3f870
netpbm-devel-10.25-2.EL4.1.i386.rpm SHA-256: ff0d136ea53703c213a7b53a6fb03c990368bdf9af7ec85fccced4ad6b170b51
netpbm-devel-10.25-2.EL4.1.i386.rpm SHA-256: ff0d136ea53703c213a7b53a6fb03c990368bdf9af7ec85fccced4ad6b170b51
netpbm-progs-10.25-2.EL4.1.i386.rpm SHA-256: c48c8a1f1cd1b394dd443da3e4f96196908f60345059d2326e2d1e3d82b32fd9
netpbm-progs-10.25-2.EL4.1.i386.rpm SHA-256: c48c8a1f1cd1b394dd443da3e4f96196908f60345059d2326e2d1e3d82b32fd9

Red Hat Enterprise Linux Workstation 4

SRPM
x86_64
netpbm-10.25-2.EL4.1.i386.rpm SHA-256: f21046a6766451d7e2dfc7bdfadedd4ca436350c55ad6964bb186d0d5fc3f870
netpbm-10.25-2.EL4.1.x86_64.rpm SHA-256: 311259f8b454091e05da8a18f6e642bd735235bb443b9cbb73607119ce9ba427
netpbm-devel-10.25-2.EL4.1.x86_64.rpm SHA-256: edfcf86aba0c9e3fcdcc069103edbcf75786be328123cda632430a14c63816c4
netpbm-progs-10.25-2.EL4.1.x86_64.rpm SHA-256: 504fbb901f766a9eeb8e24bc45d9e3e18475c7878c100c6f5e5622e296dc80b7
ia64
netpbm-10.25-2.EL4.1.i386.rpm SHA-256: f21046a6766451d7e2dfc7bdfadedd4ca436350c55ad6964bb186d0d5fc3f870
netpbm-10.25-2.EL4.1.ia64.rpm SHA-256: 946b29d1416a593d693fe3ed4ad80e54c89dafcfb02e2b4cd3ec32ddc1f68666
netpbm-devel-10.25-2.EL4.1.ia64.rpm SHA-256: 108ffbc5b1f35750d5c78efefd181c6e00dcb0f8f9b0bdd51887cd0ac088d81e
netpbm-progs-10.25-2.EL4.1.ia64.rpm SHA-256: 8664ae2e6c8623af0d0c69efa97a636a1971a6a12a3ea5300d25e41b6bc36963
i386
netpbm-10.25-2.EL4.1.i386.rpm SHA-256: f21046a6766451d7e2dfc7bdfadedd4ca436350c55ad6964bb186d0d5fc3f870
netpbm-devel-10.25-2.EL4.1.i386.rpm SHA-256: ff0d136ea53703c213a7b53a6fb03c990368bdf9af7ec85fccced4ad6b170b51
netpbm-progs-10.25-2.EL4.1.i386.rpm SHA-256: c48c8a1f1cd1b394dd443da3e4f96196908f60345059d2326e2d1e3d82b32fd9

Red Hat Enterprise Linux Desktop 4

SRPM
x86_64
netpbm-10.25-2.EL4.1.i386.rpm SHA-256: f21046a6766451d7e2dfc7bdfadedd4ca436350c55ad6964bb186d0d5fc3f870
netpbm-10.25-2.EL4.1.x86_64.rpm SHA-256: 311259f8b454091e05da8a18f6e642bd735235bb443b9cbb73607119ce9ba427
netpbm-devel-10.25-2.EL4.1.x86_64.rpm SHA-256: edfcf86aba0c9e3fcdcc069103edbcf75786be328123cda632430a14c63816c4
netpbm-progs-10.25-2.EL4.1.x86_64.rpm SHA-256: 504fbb901f766a9eeb8e24bc45d9e3e18475c7878c100c6f5e5622e296dc80b7
i386
netpbm-10.25-2.EL4.1.i386.rpm SHA-256: f21046a6766451d7e2dfc7bdfadedd4ca436350c55ad6964bb186d0d5fc3f870
netpbm-devel-10.25-2.EL4.1.i386.rpm SHA-256: ff0d136ea53703c213a7b53a6fb03c990368bdf9af7ec85fccced4ad6b170b51
netpbm-progs-10.25-2.EL4.1.i386.rpm SHA-256: c48c8a1f1cd1b394dd443da3e4f96196908f60345059d2326e2d1e3d82b32fd9

Red Hat Enterprise Linux for IBM z Systems 4

SRPM
s390x
netpbm-10.25-2.EL4.1.s390.rpm SHA-256: fecc986f469127eb781214eb6ec5f027d2346b031b484b94075b4b891732cb61
netpbm-10.25-2.EL4.1.s390x.rpm SHA-256: 78bfb93cc78d18a3a7097e9462d2dc68fb58e77139ad51a6be2d2e5ba66d75d4
netpbm-devel-10.25-2.EL4.1.s390x.rpm SHA-256: 2c31efc9116b9262ce28cb9ed51e457cae9fade1415dc44751aa90fca6819e07
netpbm-progs-10.25-2.EL4.1.s390x.rpm SHA-256: 1d0aba3598e562fbee9a39d7eee1010866933a50891e758cd564de5e17d38db0
s390
netpbm-10.25-2.EL4.1.s390.rpm SHA-256: fecc986f469127eb781214eb6ec5f027d2346b031b484b94075b4b891732cb61
netpbm-devel-10.25-2.EL4.1.s390.rpm SHA-256: 93fb619787b9d47b4bfcc3f7b8e839cfcded83deb98e40de298b4be8cfeeaf42
netpbm-progs-10.25-2.EL4.1.s390.rpm SHA-256: 4eee8aba383863e588fef08272540819c0f2be078388cd10d1117efa4c974ab6

Red Hat Enterprise Linux for Power, big endian 4

SRPM
ppc
netpbm-10.25-2.EL4.1.ppc.rpm SHA-256: fc89bd1b8879ebe456a3308519c43fe57a2ab757ea302d546774ac65af9f2381
netpbm-10.25-2.EL4.1.ppc64.rpm SHA-256: ad79f78e252b44b26f4146d7e39c1c9a21ad32dd95f2ca6d7591dc3f472bdb70
netpbm-devel-10.25-2.EL4.1.ppc.rpm SHA-256: e384743964d77b7d3328045c3ae2ee065c37c6ac7b4097a9724f3505fc0e2237
netpbm-progs-10.25-2.EL4.1.ppc.rpm SHA-256: dc0c339e66c9296ff8b45024b28245c943512bb9479fc120a922250f31173e98

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.