USN-164-1: netpbm vulnerability
11 August 2005
netpbm vulnerability
Releases
Details
Max Vozeler discovered that the the "pstopnm" conversion tool did not
use the -dSAFER option when calling ghostscript. This option prohibits
file operations and calling commands within PostScript code. This flaw
could be exploited by an attacker to execute arbitrary code if he
tricked an user (or an automatic server) into processing a specially
crafted PostScript document with pstopnm.
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 5.04
-
netpbm
-
Ubuntu 4.10
-
netpbm
-
In general, a standard system update will make all the necessary changes.