CVE-2005-2978

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2005-10-18 · updated 2026-06-16

Description

pnmtopng in netpbm before 10.25, when using the -trans option, uses uninitialized size and index variables when converting Portable Anymap (PNM) images to Portable Network Graphics (PNG), which might allow attackers to execute arbitrary code by modifying the stack.

Affected products

Netpbm: 10.0, 10.1, 10.2, 10.3, 10.4, 10.5 (+19)

References

http://secunia.com/advisories/17221
http://secunia.com/advisories/17222
http://secunia.com/advisories/17256
http://secunia.com/advisories/17265
http://secunia.com/advisories/17282
http://secunia.com/advisories/17357
http://securitytracker.com/id?1015071
http://www.debian.org/security/2005/dsa-878
http://www.gentoo.org/security/en/glsa/glsa-200510-18.xml
http://www.novell.com/linux/security/advisories/2005_24_sr.html
http://www.redhat.com/support/errata/RHSA-2005-793.html
http://www.securityfocus.com/bid/15128

Get alerted when CVE-2005-2978 or the next vulnerability affects your stack