Test ID:	1.3.6.1.4.1.25623.1.0.70497
Category:	Red Hat Local Security Checks
Title:	RedHat Security Advisory RHSA-2011:1811
Summary:	Redhat Security Advisory RHSA-2011:1811
Description:	The remote host is missing updates announced in advisory RHSA-2011:1811. The netpbm packages contain a library of functions which support programs for handling various graphics file formats, including .pbm (Portable Bit Map), .pgm (Portable Gray Map), .pnm (Portable Any Map), .ppm (Portable Pixel Map), and others. Two heap-based buffer overflow flaws were found in the embedded JasPer library, which is used to provide support for Part 1 of the JPEG 2000 image compression standard in the jpeg2ktopam and pamtojpeg2k tools. An attacker could create a malicious JPEG 2000 compressed image file that could cause jpeg2ktopam to crash or, potentially, execute arbitrary code with the privileges of the user running jpeg2ktopam. These flaws do not affect pamtojpeg2k. (CVE-2011-4516, CVE-2011-4517) A stack-based buffer overflow flaw was found in the way the xpmtoppm tool processed X PixMap (XPM) image files. An attacker could create a malicious XPM file that would cause xpmtoppm to crash or, potentially, execute arbitrary code with the privileges of the user running xpmtoppm. (CVE-2009-4274) Red Hat would like to thank Jonathan Foote of the CERT Coordination Center for reporting the CVE-2011-4516 and CVE-2011-4517 issues. All users of netpbm are advised to upgrade to these updated packages, which contain backported patches to correct these issues. Solution: Please note that this update is available via Red Hat Network. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date http://rhn.redhat.com/errata/RHSA-2011-1811.html Risk factor : High
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2009-4274 http://www.openwall.com/lists/oss-security/2010/02/09/11 Debian Security Information: DSA-2026 (Google Search) http://www.debian.org/security/2010/dsa-2026 http://www.mandriva.com/security/advisories?name=MDVSA-2010:039 http://www.redhat.com/support/errata/RHSA-2011-1811.html SuSE Security Announcement: SUSE-SR:2010:006 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00004.html BugTraq ID: 38164 http://www.securityfocus.com/bid/38164 http://secunia.com/advisories/38530 http://secunia.com/advisories/38915 http://www.vupen.com/english/advisories/2010/0358 http://www.vupen.com/english/advisories/2010/0780 XForce ISS Database: netpbm-xpm-bo(56207) http://xforce.iss.net/xforce/xfdb/56207 Common Vulnerability Exposure (CVE) ID: CVE-2011-4516 Debian Security Information: DSA-2371 (Google Search) http://www.debian.org/security/2011/dsa-2371 http://lists.fedoraproject.org/pipermail/package-announce/2012-January/071561.html http://lists.fedoraproject.org/pipermail/package-announce/2011-December/071458.html http://www.redhat.com/support/errata/RHSA-2011-1807.html SuSE Security Announcement: openSUSE-SU-2011:1317 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2011-12/msg00010.html http://www.ubuntu.com/usn/USN-1315-1 CERT/CC vulnerability note: VU#887409 http://www.kb.cert.org/vuls/id/887409 http://osvdb.org/77595 http://secunia.com/advisories/47306 http://secunia.com/advisories/47353 http://secunia.com/advisories/47193 Common Vulnerability Exposure (CVE) ID: CVE-2011-4517 http://osvdb.org/77596 XForce ISS Database: jasper-jpccrggetparms-bo(71701) http://xforce.iss.net/xforce/xfdb/71701
Copyright	Copyright (c) 2012 E-Soft Inc. http://www.securityspace.com

This is only one of 32582 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.

New User Registration Email: UserID: Passwd: Please email me your monthly newsletters, informing the latest services, improvements & surveys. Please email me a vulnerability test announcement whenever a new test is added.     Privacy

Registered User Login   UserID:     Passwd:     Forgot userid or passwd? Email/Userid: