CVE-2006-3376 Integer overflow in player.c in libwmf 0.2.8.4, as used in multiple products including (1) wv, (2) abiword, (3) freetype, (4) gimp, (5) libgsf, and (6) imagemagick allows remote attackers to execute a...
HighCVSS 7.5
EPSS 7.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Integer overflow in player.c in libwmf 0.2.8.4, as used in multiple products including (1) wv, (2) abiword, (3) freetype, (4) gimp, (5) libgsf, and (6) imagemagick allows remote attackers to execute arbitrary code via the MaxRecordSize header field in a WMF file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| wvware libwmf | = 0.2.8_.4 | No fix listed |
| wvware wv2 | = 0.2.1 | No fix listed |
| wvware wv2 | = 0.2.2 | No fix listed |
| wvware wv2 | = 0.2.3 | No fix listed |
| debian/libwmf(Debian:12) | < 0.2.8.4-2 | 0.2.8.4-2 |
| debian/libwmf(Debian:13) | < 0.2.8.4-2 | 0.2.8.4-2 |
| debian/libwmf(Debian:14) | < 0.2.8.4-2 | 0.2.8.4-2 |
References
- RHSA-2006:0597 vendor-advisory
- 20921 third-party-advisory vendor-advisory
- 21064 third-party-advisory
- 21261 third-party-advisory
- 21419 third-party-advisory
- 21459 third-party-advisory
- 21473 third-party-advisory
- 22311 third-party-advisory
- GLSA-200608-17 vendor-advisory
- 1190 third-party-advisory
- 1016518 vdb-entry
- MDKSA-2006:132 vendor-advisory
- SUSE-SR:2006:019 vendor-advisory
- 20060630 libwmf integer/heap overflow mailing-list
- 18751 vdb-entry
- USN-333-1 vendor-advisory
- ADV-2006-2646 vdb-entry
- libwmf-wmf-bo(27516) vdb-entry
- oval:org.mitre.oval:def:10262 signature vdb-entry
- DSA-1194 vendor-advisory
- Debian Security Tracker CVE-2006-3376 vendor-advisory
- bugs.debian.org issue-tracking