PT-2004-1087 · Netpbm · Netpbm

Matt Zimmerman · Published 2004-02-05 · Updated 2017-10-10 · CVE-2003-0924

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions netpbm versions 9.25 and earlier netpbm versions prior to 9.12-r4

Description The issue affects the netpbm package, allowing for potential disruption of confidentiality, integrity, and availability of protected information. Exploitation can be carried out remotely or locally, depending on the specific vulnerability. The problem is related to the improper creation of temporary files, which can enable local users to overwrite arbitrary files.

Recommendations For netpbm versions 9.25 and earlier, update to a version later than 9.25 to resolve the issue. For netpbm versions prior to 9.12-r4, update to a version later than 9.12-r4 to resolve the issue. As a temporary workaround, consider restricting access to the netpbm package to minimize the risk of exploitation.

Fix

Related Identifiers

BDU:2015-08170

BDU:2015-08171

BDU:2015-08172

BDU:2015-09454

CVE-2003-0924

DSA-426

RHSA-2004:031

Affected Products

Netpbm

References · 21

• https://bdu.fstec.ru/vul/2015-08170 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2003-0924 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09454 · Security Note
• http://gentoo.org/security/en/glsa/glsa-200410-02.xml · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2004-030.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2003-0924 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2003-0924 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-08171 · Security Note
• http://debian.org/security/2004/dsa-426 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2003-0924 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2004-031.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-08172 · Security Note
• http://securityfocus.com/bid/9442 · Vendor Advisory
• ftp://patches.sgi.com/support/free/security/advisories/20040201-01-U.asc · Vendor Advisory
• http://mandrakesoft.com/security/advisories?name=MDKSA-2004:011 · Vendor Advisory