Source: netpbm-free Version: 2:11.13.03+ds-2 Severity: important Tags: security upstream X-Debbugs-Cc: Debian Security Team <[email protected]>
Hi, Five of the Netpbm CVEs published in the batch CVE-2026-120431..120437 affect netpbm-free in every suite I checked: 11.01.00-2 (oldstable), 11.10.02-1 (stable), 11.13.03+ds-2 (testing/unstable) and 11.15.04+ds-1 (experimental). All five programs are shipped in the netpbm binary package. Upstream fixed them on trunk and released the fixes in 11.15.08 (and 11.02.30 / 10.86.51). The revisions below are in upstream's Netpbm SVN repository on SourceForge; the security tracker entries for each CVE link the trunk commit. CVE-2026-120431 - sgitopnm: buffer overrun when the RLE offset table gives invalidly long data for a line trunk r5317, advanced branch r5318 CVE-2026-120432 - winicontopam: arithmetic overflow with large images, leading to out-of-bounds memory access and infinite loops trunk r5335 CVE-2026-120435 - xpmtoppm: buffer overruns with an invalid characters-per-pixel value (upstream's HISTORY entry says "ppmtoxpm", but the change is in converter/ppm/xpmtoppm.c) trunk r5336 CVE-2026-120436 - jbigtopnm: arithmetic overflow / buffer overrun with a very large input image trunk r5324 CVE-2026-120437 - tgatoppm: buffer overrun with corrupted Targa input; invalid color indexes are now rejected trunk r5334 The advanced-branch changes (r5318 for sgitopnm, and r5357, which is the 11.15.08 release, for the other four) apply to the Debian source of all four suites with at most a few lines of offset and no fuzz, so the affected code is unchanged in Debian. I have not tried to reproduce the crashes. Moving experimental to 11.15.08 or later would fix all five there. For the stable suites, the per-file changes above should be usable as patches. The two other CVEs from the same batch, CVE-2026-120433 and CVE-2026-120434, are in picttoppm. Debian does not build picttoppm (debian/patches/10_netpbm-security-code.patch removes it from converter/ppm/Makefile), so they don't affect Debian. I'm sending that to the security tracker separately. Regards, Sumit Verma
