The pm_mallocarray2 function in lib/util/mallocvar.c in Netpbm through 10.81.03 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted image file, as demonstrated by pbmmask.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Huawei Euleros 2_0_sp2 | — | Upgrade netpbm-progsUpgrade netpbmUpgrade netpbm-devel | Dec 4, 2019 | Mar 25, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade netpbm-progsUpgrade netpbm-develUpgrade netpbm | Dec 18, 2019 | Mar 25, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade netpbm-progsUpgrade netpbmUpgrade netpbm-devel | Nov 19, 2019 | Mar 25, 2018 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Mar 25, 2018 |
| Suse | — | Upgrade libnetpbm11-32bitUpgrade libnetpbm-develUpgrade netpbmUpgrade libnetpbm11 | Apr 13, 2019 | Mar 24, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub