Hi,

Five of the Netpbm CVEs published in the batch CVE-2026-120431..120437
affect netpbm-free in every suite I checked: 11.01.00-2 (oldstable),
11.10.02-1 (stable), 11.13.03+ds-2 (testing/unstable) and 11.15.04+ds-1
(experimental). All five programs are shipped in the netpbm binary package.
Upstream fixed them on trunk and released the fixes in 11.15.08 (and
11.02.30 / 10.86.51).

The revisions below are in upstream's Netpbm SVN repository on SourceForge;
the security tracker entries for each CVE link the trunk commit.

CVE-2026-120431 - sgitopnm: buffer overrun when the RLE offset table gives
invalidly long data for a line
trunk r5317, advanced branch r5318

CVE-2026-120432 - winicontopam: arithmetic overflow with large images,
leading to out-of-bounds memory access and infinite loops
trunk r5335

CVE-2026-120435 - xpmtoppm: buffer overruns with an invalid
characters-per-pixel value (upstream's HISTORY entry says "ppmtoxpm", but
the change is in converter/ppm/xpmtoppm.c)
trunk r5336

CVE-2026-120436 - jbigtopnm: arithmetic overflow / buffer overrun with a
very large input image
trunk r5324

CVE-2026-120437 - tgatoppm: buffer overrun with corrupted Targa input;
invalid color indexes are now rejected
trunk r5334

The advanced-branch changes (r5318 for sgitopnm, and r5357, which is the
11.15.08 release, for the other four) apply to the Debian source of all
four suites with at most a few lines of offset and no fuzz, so the affected
code is unchanged in Debian. I have not tried to reproduce the crashes.

Moving experimental to 11.15.08 or later would fix all five there. For the
stable suites, the per-file changes above should be usable as patches.

The two other CVEs from the same batch, CVE-2026-120433 and
CVE-2026-120434, are in picttoppm. Debian does not build picttoppm
(debian/patches/10_netpbm-security-code.patch removes it from
converter/ppm/Makefile), so they don't affect Debian. I'm sending that to
the security tracker separately.

Regards,
Sumit Verma