CVE-2018-8975

Published: Mar 25, 2018Modified: Jun 17, 2026

5.5

Vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

The pm_mallocarray2 function in lib/util/mallocvar.c in Netpbm through 10.81.03 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted image file, as demonstrated by pbmmask.

Affected (1)

Products: Netpbm Project: Netpbm

Netpbm Project

1 product

Netpbm

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Netpbm Project Netpbm	Up to 10.81.03

Related CWEs

CWE-125

Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

References (8)

http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00056.html

Source: cve@mitre.org

https://github.com/xiaoqx/pocs/blob/master/netpbm

Source: cve@mitre.org

ExploitThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LVMWVVFEADMA7XIPXFHGSBRYKEGGDFGE/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VEZRUJ5LNGULJL7QUAHPV5LBOKIJYP5I/

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00056.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/xiaoqx/pocs/blob/master/netpbm

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LVMWVVFEADMA7XIPXFHGSBRYKEGGDFGE/

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VEZRUJ5LNGULJL7QUAHPV5LBOKIJYP5I/

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.