The pm_mallocarray2 function in lib/util/mallocvar.c in Netpbm through 10.81.03 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted image file, as demonstrated by pbmmask.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Huawei Euleros 2_0_sp2 | — | Upgrade netpbm-progsUpgrade netpbm-develUpgrade netpbm | Dec 4, 2019 | Mar 25, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade netpbm-progsUpgrade netpbmUpgrade netpbm-devel | Dec 18, 2019 | Mar 25, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade netpbm-develUpgrade netpbm-progsUpgrade netpbm | Nov 19, 2019 | Mar 25, 2018 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Mar 25, 2018 |
| Suse | — | Upgrade libnetpbm11Upgrade libnetpbm-develUpgrade libnetpbm11-32bitUpgrade netpbm | Apr 13, 2019 | Mar 24, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub