Mandriva Linux Security Advisory : netpbm (MDVSA-2009:317)

critical Nessus Plugin ID 43020
New! Vulnerability Priority Rating (VPR)

Tenable calculates a dynamic VPR for every vulnerability. VPR combines vulnerability information with threat intelligence and machine learning algorithms to predict which vulnerabilities are most likely to be exploited in attacks. Read more about what VPR is and how it is different from CVSS.

VPR Score: 5.9

Synopsis

The remote Mandriva Linux host is missing one or more security updates.

Description

Multiple security vulnerabilities has been identified and fixed in netpbm :

Multiple integer overflows in JasPer 1.900.1 might allow context-dependent attackers to have an unknown impact via a crafted image file, related to integer multiplication for memory allocation (CVE-2008-3520).

Buffer overflow in the jas_stream_printf function in libjasper/base/jas_stream.c in JasPer 1.900.1 might allow context-dependent attackers to have an unknown impact via vectors related to the mif_hdr_put function and use of vsprintf (CVE-2008-3522).

pamperspective in Netpbm before 10.35.48 does not properly calculate a window height, which allows context-dependent attackers to cause a denial of service (crash) via a crafted image file that triggers an out-of-bounds read (CVE-2008-4799).

Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers

This update fixes this vulnerability.

Solution

Update the affected packages.

Plugin Details

Severity: Critical

ID: 43020

File Name: mandriva_MDVSA-2009-317.nasl

Version: 1.18

Type: local

Published: 12/7/2009

Updated: 1/6/2021

Dependencies: ssh_get_info.nasl

Risk Information

Risk Factor: Critical

VPR Score: 5.9

CVSS v2.0

Base Score: 10

Temporal Score: 7.4

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

Temporal Vector: E:U/RL:OF/RC:C

Vulnerability Information

CPE: p-cpe:/a:mandriva:linux:lib64netpbm-devel, p-cpe:/a:mandriva:linux:lib64netpbm-static-devel, p-cpe:/a:mandriva:linux:lib64netpbm10, p-cpe:/a:mandriva:linux:libnetpbm-devel, p-cpe:/a:mandriva:linux:libnetpbm-static-devel, p-cpe:/a:mandriva:linux:libnetpbm10, p-cpe:/a:mandriva:linux:netpbm, cpe:/o:mandriva:linux:2008.0

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/Mandrake/release, Host/Mandrake/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 12/5/2009

Reference Information

CVE: CVE-2008-3520, CVE-2008-3522, CVE-2008-4799

BID: 31470

MDVSA: 2009:317

CWE: 119, 189