Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 551144 (CVE-2015-0848) - <media-libs/libwmf-0.2.8.4-r6: heap overflow when decoding BMP images (CVE-2015-0848)
Summary: <media-libs/libwmf-0.2.8.4-r6: heap overflow when decoding BMP images (CVE-20...
Status: RESOLVED FIXED
Alias: CVE-2015-0848
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
URL: https://bugzilla.redhat.com/show_bug....
Whiteboard: B2 [glsa cve]
Keywords:
Depends on:
Blocks:
 
Reported: 2015-06-04 07:17 UTC by Agostino Sarubbo
Modified: 2016-02-27 01:45 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2015-06-04 07:17:21 UTC 
From ${URL} :

A heap buffer overflow flaw was found in the way the libwmf library processed WMF files containing 
BMP images. A specially crafted WMF file could cause an application using libwmf to crash or, 
possibly, execute arbitrary code.

Original report:

http://seclists.org/oss-sec/2015/q2/597


@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.
Comment 1 Alexander Tsoy 2015-11-03 18:16:00 UTC 
This security issue was fixed in =media-libs/libwmf-0.2.8.4-r6
Comment 2 Yury German Gentoo Infrastructure gentoo-dev 2015-11-03 20:24:13 UTC 
Maintainer(s), please advise if you when you are ready for stabilization or call for stabilization yourself.
Comment 3 Jeroen Roovers (RETIRED) gentoo-dev 2015-11-06 04:37:03 UTC 
Stable for HPPA PPC64.
Comment 4 Agostino Sarubbo gentoo-dev 2015-11-06 11:27:42 UTC 
amd64 stable
Comment 5 Agostino Sarubbo gentoo-dev 2015-11-06 11:28:20 UTC 
x86 stable
Comment 6 Agostino Sarubbo gentoo-dev 2015-11-09 08:54:08 UTC 
ppc stable
Comment 7 Markus Meier gentoo-dev 2015-11-14 16:45:21 UTC 
arm stable
Comment 8 Agostino Sarubbo gentoo-dev 2015-11-18 09:33:25 UTC 
ia64 stable
Comment 9 Mikle Kolyada (RETIRED) archtester Gentoo Infrastructure gentoo-dev Security 2015-12-27 10:41:38 UTC 
sparc stable
Comment 10 Agostino Sarubbo gentoo-dev 2016-01-10 10:41:23 UTC 
alpha stable.

Maintainer(s), please cleanup.
Security, please add it to the existing request, or file a new one.
Comment 11 Michael Palimaka (kensington) gentoo-dev 2016-01-10 14:20:56 UTC 
Old removed.
Comment 12 Yury German Gentoo Infrastructure gentoo-dev 2016-02-25 06:54:41 UTC 
Arches and Maintainer(s), Thank you for your work.
Added to an existing GLSA Request.
Comment 13 GLSAMaker/CVETool Bot gentoo-dev 2016-02-27 01:45:36 UTC 
This issue was resolved and addressed in
 GLSA 201602-03 at https://security.gentoo.org/glsa/201602-03
by GLSA coordinator Kristian Fiskerstrand (K_F).