CVE-2017-5849
tiffttopnm in netpbm 10.47.63 does not properly use the libtiff TIFFRGBAImageGet function, which...
tiffttopnm in netpbm 10.47.63 does not properly use the libtiff TIFFRGBAImageGet function, which allows remote attackers to cause a denial of service (out-of-bounds read and write) via a crafted tiff image file, related to transposing width and height values.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
tiffttopnm in netpbm 10.47.63 does not properly use the libtiff TIFFRGBAImageGet function, which allows remote attackers to cause a denial of service (out-of-bounds read and write) via a crafted tiff image file, related to transposing width and height values.
- Record
CVE-2017-5849- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-125, CWE-787
- Updated
- 2026-11-02
CVE List No score
tiffttopnm in netpbm 10.47.63 does not properly use the libtiff TIFFRGBAImageGet function, which allows remote attackers to cause a denial of service (out-of-bounds read and write) via a crafted tiff image file, related to transposing width and height values.
- Record
CVE-2017-5849- Updated
- 2026-11-02
EUVDEUVD-2017-14926 No score
tiffttopnm in netpbm 10.47.63 does not properly use the libtiff TIFFRGBAImageGet function, which allows remote attackers to cause a denial of service (out-of-bounds read and write) via a crafted tiff image file, related to transposing width and height values.
- Record
EUVD-2017-14926- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7c32-9pjx-pj89
tiffttopnm in netpbm 10.47.63 does not properly use the libtiff TIFFRGBAImageGet function, which...
tiffttopnm in netpbm 10.47.63 does not properly use the libtiff TIFFRGBAImageGet function, which allows remote attackers to cause a denial of service (out-of-bounds read and write) via a crafted tiff image file, related to transposing width and height values.
- Record
GHSA-7c32-9pjx-pj89- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13655-1 No score
libnetpbm-devel-11.5.2-2.1 on GA media
These are all security issues fixed in the libnetpbm-devel-11.5.2-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13655-1- Updated
- 2026-11-02
OSVSUSE-SU-2024:0434-1 No score
Security update for netpbm
This update for netpbm fixes the following issues:
- CVE-2017-5849: Fixed out-of-bound read and write issue that can occur in function putgreytile() and put1bitbwtile() (bsc#1022790, bsc#1022791).
- Record
SUSE-SU-2024:0434-1- Updated
- 2026-11-02
OSVSUSE-SU-2024:0435-1 No score
Security update for netpbm
This update for netpbm fixes the following issues:
- CVE-2017-5849: Fixed out-of-bound read and write issue that can occur in function putgreytile() and put1bitbwtile() (bsc#1022790, bsc#1022791).
- Record
SUSE-SU-2024:0435-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
netpbmSUSE:Linux Enterprise Software Development Kit 12 SP5 |
before 10.66.3-8.10.1 | 10.66.3-8.10.1 |
netpbmSUSE:Linux Enterprise Server 12 SP5 |
before 10.66.3-8.10.1 | 10.66.3-8.10.1 |
netpbmSUSE:Linux Enterprise Server for SAP Applications 12 SP5 |
before 10.66.3-8.10.1 | 10.66.3-8.10.1 |
netpbmSUSE:Linux Enterprise Module for Basesystem 15 SP5 |
before 10.80.1-150000.3.14.1 | 10.80.1-150000.3.14.1 |
netpbmSUSE:Linux Enterprise Module for Desktop Applications 15 SP5 |
before 10.80.1-150000.3.14.1 | 10.80.1-150000.3.14.1 |
netpbmopenSUSE:Leap 15.5 |
before 10.80.1-150000.3.14.1 | 10.80.1-150000.3.14.1 |
netpbmopenSUSE:Tumbleweed |
before 11.5.2-2.1 | 11.5.2-2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-5849 is a medium vulnerability (CVSS 5.5) in Netpbm Project Netpbm, published March 15, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.93%, the 80th percentile. Fixed in netpbm 10.66.3-8.10.1.
References
bugzilla.maptools.org/show_bug.cgi?id=2655
openwall.com/lists/oss-security/2017/02/02/2
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AF42A624FXVY3BYBHMAO6F2X7EJYHQE2
securityfocus.com/bid/96011
Show 9 moreShow less
nvd.nist.gov/vuln/detail/CVE-2017-5849
github.com/advisories/GHSA-7c32-9pjx-pj89
suse.com/support/update/announcement/2024/suse-su-20240434-1
bugzilla.suse.com/1022790