File _patchinfo of Package patchinfo.7895

<patchinfo incident="7895">
  <issue tracker="bnc" id="1086777">VUL-1: CVE-2018-8975: netpbm: The pm_mallocarray2 function in lib/util/mallocvar.c in Netpbm through 10.81.03allows remote attackers to cause a denial of service (heap-based bufferover-read) via a crafted image file, as demonstrated by pb</issue>
  <issue id="1024288" tracker="bnc">VUL-1: CVE-2017-2579: netpbm: Out-of-bounds read in expandCodeOntoStack()</issue>
  <issue id="1024291" tracker="bnc">VUL-0: CVE-2017-2580: netpbm: Out-of-bounds write of heap data in addPixelToRaster() function</issue>
  <issue id="1136936" tracker="bnc">VUL-0: netpbm: disable / move out postscript decoding using ghostscript</issue>
  <issue tracker="cve" id="2018-8975"/>
  <issue id="2017-2579" tracker="cve" />
  <issue id="2017-2580" tracker="cve" />
  <category>security</category>
  <rating>moderate</rating>
  <packager>pgajdos</packager>
  <description>This update for netpbm fixes the following issues:

Security issues fixed:

- CVE-2018-8975: The pm_mallocarray2 function allowed remote attackers to cause
  a denial of service (heap-based buffer over-read) via a crafted image file (bsc#1086777).
- CVE-2017-2579: Fixed out-of-bounds read in expandCodeOntoStack() (bsc#1024288).
- CVE-2017-2580: Fixed out-of-bounds write of heap data in addPixelToRaster() function (bsc#1024291).

- create netpbm-vulnerable subpackage and move pstopnm there (bsc#1136936)

</description>
  <summary>Security update for netpbm</summary>
</patchinfo>