_______________________________________________________________________

Mandriva Linux Security Advisory                         MDVSA-2010:039
http://www.mandriva.com/security/
_______________________________________________________________________

Package : netpbm
Date    : February 17, 2010
Affected: 2008.0, 2009.0, 2009.1, 2010.0, Corporate 4.0,
Enterprise Server 5.0
_______________________________________________________________________

Problem Description:

A vulnerability have been discovered and corrected in netpbm:

Stack-based buffer overflow in converter/ppm/xpmtoppm.c in netpbm  before 10.47.07 allows context-dependent attackers to cause a denial  of service (application crash) or possibly execute arbitrary code  via an XPM image file that contains a crafted header field associated  with a large color index value (CVE-2009-4274).

Packages for 2008.0 are provided for Corporate Desktop 2008.0  customers.

The updated packages have been patched to correct this issue.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4274
_______________________________________________________________________

Updated Packages:

Mandriva Linux 2008.0:
8bcad87072eb2e7bc56fb0dd5b85259a  2008.0/i586/libnetpbm10-10.34-8.4mdv2008.0.i586.rpm
59ed2a66a9b7ba7892e8eca4fb13881c  2008.0/i586/libnetpbm-devel-10.34-8.4mdv2008.0.i586.rpm
531166ffe9840c4acc26df23709e22fd  2008.0/i586/libnetpbm-static-devel-10.34-8.4mdv2008.0.i586.rpm
2a84ec450978bf42f52a5e769c1cae9d  2008.0/i586/netpbm-10.34-8.4mdv2008.0.i586.rpm
575de6109fea969f98e92e94b042dda0  2008.0/SRPMS/netpbm-10.34-8.4mdv2008.0.src.rpm

Mandriva Linux 2008.0/X86_64:
290a4caf55e0363712b56c275ba04ce0  2008.0/x86_64/lib64netpbm10-10.34-8.4mdv2008.0.x86_64.rpm
f6ae08756eaa4dce2627a85085e17b46  2008.0/x86_64/lib64netpbm-devel-10.34-8.4mdv2008.0.x86_64.rpm
2b49a1468231d86ad516b747af7984c2  2008.0/x86_64/lib64netpbm-static-devel-10.34-8.4mdv2008.0.x86_64.rpm
e866478a921c955840a333ecf80ac46c  2008.0/x86_64/netpbm-10.34-8.4mdv2008.0.x86_64.rpm
575de6109fea969f98e92e94b042dda0  2008.0/SRPMS/netpbm-10.34-8.4mdv2008.0.src.rpm

Mandriva Linux 2009.0:
ee1ea92d859e3e7373775fe5a3a22bbb  2009.0/i586/libnetpbm10-10.35.46-1.2mdv2009.0.i586.rpm
ace5a3ba900ad6a557588475e3bef3a8  2009.0/i586/libnetpbm-devel-10.35.46-1.2mdv2009.0.i586.rpm
00b33b00223a2cc933b4c8ec0f0abdb1  2009.0/i586/libnetpbm-static-devel-10.35.46-1.2mdv2009.0.i586.rpm
bd9d8c7dbf383bd9784f64557d63b5fc  2009.0/i586/netpbm-10.35.46-1.2mdv2009.0.i586.rpm
bfd3a9bc163067b71537abc9d400ff00  2009.0/SRPMS/netpbm-10.35.46-1.2mdv2009.0.src.rpm

Mandriva Linux 2009.0/X86_64:
f635d7ef616dee3da2a71674daeaaf52  2009.0/x86_64/lib64netpbm10-10.35.46-1.2mdv2009.0.x86_64.rpm
365fe028aa3a53a6bc7929a5bbbef00f  2009.0/x86_64/lib64netpbm-devel-10.35.46-1.2mdv2009.0.x86_64.rpm
c3dbd8ad3f9b592e39a8f2141c872a45  2009.0/x86_64/lib64netpbm-static-devel-10.35.46-1.2mdv2009.0.x86_64.rpm
e5a66e406c325bfab3be1552d0b07898  2009.0/x86_64/netpbm-10.35.46-1.2mdv2009.0.x86_64.rpm
bfd3a9bc163067b71537abc9d400ff00  2009.0/SRPMS/netpbm-10.35.46-1.2mdv2009.0.src.rpm

Mandriva Linux 2009.1:
779d04e7a3aaebcad8466198512da832  2009.1/i586/libnetpbm10-10.35.59-1.1mdv2009.1.i586.rpm
cab822b6ada4810e636f59fd5f973f89  2009.1/i586/libnetpbm-devel-10.35.59-1.1mdv2009.1.i586.rpm
a3368b94646adc06eaf89ce10eb5a2b9  2009.1/i586/libnetpbm-static-devel-10.35.59-1.1mdv2009.1.i586.rpm
93b6279a74590026b1e16ea7473ddb97  2009.1/i586/netpbm-10.35.59-1.1mdv2009.1.i586.rpm
55555730694672069956ccccaa0d890b  2009.1/SRPMS/netpbm-10.35.59-1.1mdv2009.1.src.rpm

Mandriva Linux 2009.1/X86_64:
8f412a3a9e0a3655c6431f75d2694ef9  2009.1/x86_64/lib64netpbm10-10.35.59-1.1mdv2009.1.x86_64.rpm
3ff3df2d1bd3ae81be50de6f62c81cf4  2009.1/x86_64/lib64netpbm-devel-10.35.59-1.1mdv2009.1.x86_64.rpm
bc23d8105469a7d597b71bf51d49dcb8  2009.1/x86_64/lib64netpbm-static-devel-10.35.59-1.1mdv2009.1.x86_64.rpm
5a5158cf3c372be6c9a0db33e026f1f7  2009.1/x86_64/netpbm-10.35.59-1.1mdv2009.1.x86_64.rpm
55555730694672069956ccccaa0d890b  2009.1/SRPMS/netpbm-10.35.59-1.1mdv2009.1.src.rpm

Mandriva Linux 2010.0:
4fa5cc0fd4bc8a7886d33c6ba937e701  2010.0/i586/libnetpbm10-10.35.64-4.1mdv2010.0.i586.rpm
aeecf29a8b0ba59493cee20f7057356d  2010.0/i586/libnetpbm-devel-10.35.64-4.1mdv2010.0.i586.rpm
e2fa1d2b95b9adeb79bbb3fab08a2b6d  2010.0/i586/libnetpbm-static-devel-10.35.64-4.1mdv2010.0.i586.rpm
c11938419e48ae2ac9d237955324e899  2010.0/i586/netpbm-10.35.64-4.1mdv2010.0.i586.rpm
efb8bf31dfedfe90726c343daa917e1a  2010.0/SRPMS/netpbm-10.35.64-4.1mdv2010.0.src.rpm

Mandriva Linux 2010.0/X86_64:
7d1d1796786b7001c3120fdbd39c6ce2  2010.0/x86_64/lib64netpbm10-10.35.64-4.1mdv2010.0.x86_64.rpm
5c36756ee54b446e5769490f38d9c7a9  2010.0/x86_64/lib64netpbm-devel-10.35.64-4.1mdv2010.0.x86_64.rpm
d87677cb5902e4b770da31d09d5074ee  2010.0/x86_64/lib64netpbm-static-devel-10.35.64-4.1mdv2010.0.x86_64.rpm
d50867f0735a4dc22292d2e5e86a36fa  2010.0/x86_64/netpbm-10.35.64-4.1mdv2010.0.x86_64.rpm
efb8bf31dfedfe90726c343daa917e1a  2010.0/SRPMS/netpbm-10.35.64-4.1mdv2010.0.src.rpm

Corporate 4.0:
4ce1174f09ffd1a201d2700d92eb9159  corporate/4.0/i586/libnetpbm10-10.29-1.7.20060mlcs4.i586.rpm
0b23ea99e1ef82b0269b451c8a3c8ca5  corporate/4.0/i586/libnetpbm10-devel-10.29-1.7.20060mlcs4.i586.rpm
ed76d9c0709dd4096bb048c606949496  corporate/4.0/i586/libnetpbm10-static-devel-10.29-1.7.20060mlcs4.i586.rpm
eb98ce5306a3d4f48f86f9eb0ff651cb  corporate/4.0/i586/netpbm-10.29-1.7.20060mlcs4.i586.rpm
ca94f75da48df2b08f0738885e699d10  corporate/4.0/SRPMS/netpbm-10.29-1.7.20060mlcs4.src.rpm

Corporate 4.0/X86_64:
601edb209c88048519d828436aaa87a4  corporate/4.0/x86_64/lib64netpbm10-10.29-1.7.20060mlcs4.x86_64.rpm
b9fa69d18db9736e078a4a37f0e8dd53  corporate/4.0/x86_64/lib64netpbm10-devel-10.29-1.7.20060mlcs4.x86_64.rpm
008db822b44e044cffd17654a931edba  corporate/4.0/x86_64/lib64netpbm10-static-devel-10.29-1.7.20060mlcs4.x86_64.rpm
03b9c9b998d779d41d199d4fe4fc7ba3  corporate/4.0/x86_64/netpbm-10.29-1.7.20060mlcs4.x86_64.rpm
ca94f75da48df2b08f0738885e699d10  corporate/4.0/SRPMS/netpbm-10.29-1.7.20060mlcs4.src.rpm

Mandriva Enterprise Server 5:
c63f9537584cf106e536f7d83bc54081  mes5/i586/libnetpbm10-10.35.46-1.2mdvmes5.i586.rpm
986eff41c0358f28b28f611fd249adf3  mes5/i586/libnetpbm-devel-10.35.46-1.2mdvmes5.i586.rpm
816e2b8b6ad495cc614a3e2173121e5c  mes5/i586/libnetpbm-static-devel-10.35.46-1.2mdvmes5.i586.rpm
5e45816cc9bec160a2320d303b13f8a6  mes5/i586/netpbm-10.35.46-1.2mdvmes5.i586.rpm
2713691fd47d18d4af1467db4ca7329c  mes5/SRPMS/netpbm-10.35.46-1.2mdvmes5.src.rpm

Mandriva Enterprise Server 5/X86_64:
e3368f94a486303a50f9abce9f7d657a  mes5/x86_64/lib64netpbm10-10.35.46-1.2mdvmes5.x86_64.rpm
6f83d0317f9571169c4fe0db914529d9  mes5/x86_64/lib64netpbm-devel-10.35.46-1.2mdvmes5.x86_64.rpm
6c844b6530612960b3bbf1ac0d701faf  mes5/x86_64/lib64netpbm-static-devel-10.35.46-1.2mdvmes5.x86_64.rpm
793de9149882fb1cf01733a04fd5e617  mes5/x86_64/netpbm-10.35.46-1.2mdvmes5.x86_64.rpm
2713691fd47d18d4af1467db4ca7329c  mes5/SRPMS/netpbm-10.35.46-1.2mdvmes5.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi.  The verification  of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security.  You can obtain the  GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________