PT-2005-3376 · Netpbm+2 · Netpbm+2

Max Vozeler · Published 2005-08-05 · Updated 2017-10-11 · CVE-2005-2471

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions netpbm (affected versions not specified)

Description The issue concerns the pstopnm function in netpbm, which fails to properly utilize the "-dSAFER" option when invoking Ghostscript for converting PostScript files into PBM, PGM, or PNM files. This oversight enables external attackers, with user assistance, to execute arbitrary commands.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2005-2471

DSA-1021-1

RHSA-2005:743

RHSA-2005_743

Affected Products

Ghostscript

Red Hat

Netpbm

References · 19

• https://nvd.nist.gov/vuln/detail/CVE-2005-2471 · Security Note
• http://secunia.com/advisories/19436 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2005-2471 · Vendor Advisory
• http://debian.org/security/2006/dsa-1021 · Vendor Advisory
• http://trustix.org/errata/2005/0038 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2005-743.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2005-2471 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2005-2471 · Vendor Advisory
• http://secunia.com/advisories/18330 · Vendor Advisory
• http://novell.com/linux/security/advisories/2005_19_sr.html · Vendor Advisory
• http://secunia.com/advisories/16184 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/21500 · Note
• https://rhn.redhat.com/errata/RHSA-2005-743.html · Note
• https://redhat.com/security/data/cve/CVE-2005-2471.html · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11645 · Note