Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 728806 (CVE-2020-13999) - <media-libs/libemf-1.0.13: Integer overflow allowing denial of service (CVE-2020-13999)
Summary: <media-libs/libemf-1.0.13: Integer overflow allowing denial of service (CVE-2...
Status: RESOLVED FIXED
Alias: CVE-2020-13999
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL: https://sourceforge.net/p/libemf/news...
Whiteboard: B3 [noglsa cve]
Keywords:
Depends on:
Blocks: CVE-2020-11863, CVE-2020-11864, CVE-2020-11865, CVE-2020-11866
  Show dependency tree
 
Reported: 2020-06-19 18:33 UTC by Sam James
Modified: 2020-07-27 20:26 UTC (History)
1 user (show)

See Also:
Package list:
=media-libs/libemf-1.0.13
Runtime testing required: ---
nattka: sanity-check+

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Sam James archtester Gentoo Infrastructure gentoo-dev Security 2020-06-19 18:33:59 UTC 
Description:
"ScaleViewPortExtEx in libemf.cpp in libEMF (aka ECMA-234 Metafile Library) 1.0.12 allows an integer overflow and denial of service via a crafted EMF file."
Comment 1 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2020-06-19 18:34:15 UTC 
Needs bump to 1.0.13.
Comment 2 Larry the Git Cow gentoo-dev 2020-06-20 00:28:10 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=c21eb60e63bba92a6e5e80f52634222d08fc91d2

commit c21eb60e63bba92a6e5e80f52634222d08fc91d2
Author:     Sam James (sam_c) <sam@cmpct.info>
AuthorDate: 2020-06-19 18:40:10 +0000
Commit:     Aaron Bauman <bman@gentoo.org>
CommitDate: 2020-06-20 00:27:56 +0000

    media-libs/libemf: security bump to 1.0.13
    
    Bug: https://bugs.gentoo.org/728806
    Package-Manager: Portage-2.3.99, Repoman-2.3.22
    Signed-off-by: Sam James (sam_c) <sam@cmpct.info>
    Closes: https://github.com/gentoo/gentoo/pull/16331
    Signed-off-by: Aaron Bauman <bman@gentoo.org>

 media-libs/libemf/Manifest             |  1 +
 media-libs/libemf/libemf-1.0.13.ebuild | 25 +++++++++++++++++++++++++
 2 files changed, 26 insertions(+)
Comment 3 Thomas Deutschmann (RETIRED) gentoo-dev 2020-06-20 13:50:18 UTC 
x86 stable
Comment 4 Agostino Sarubbo gentoo-dev 2020-06-21 16:55:50 UTC 
amd64 stable
Comment 5 Agostino Sarubbo gentoo-dev 2020-06-21 17:04:51 UTC 
ppc stable
Comment 6 Agostino Sarubbo gentoo-dev 2020-06-21 17:09:43 UTC 
ppc64 stable
Comment 7 Agostino Sarubbo gentoo-dev 2020-06-21 17:12:56 UTC 
sparc stable.

Maintainer(s), please cleanup.
Security, please vote.
Comment 8 Larry the Git Cow gentoo-dev 2020-07-16 01:06:27 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=84aaa47fa1de53e56c742e14273b603e0dba392d

commit 84aaa47fa1de53e56c742e14273b603e0dba392d
Author:     Sam James <sam@gentoo.org>
AuthorDate: 2020-07-16 00:31:23 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2020-07-16 01:01:35 +0000

    media-libs/libemf: security cleanup
    
    Bug: https://bugs.gentoo.org/728806
    Package-Manager: Portage-2.3.99, Repoman-2.3.23
    Signed-off-by: Sam James <sam@gentoo.org>

 media-libs/libemf/Manifest                         |  3 -
 .../libemf/files/libemf-1.0.4-amd64-alpha.patch    | 95 ----------------------
 media-libs/libemf/libemf-1.0.12.ebuild             | 25 ------
 media-libs/libemf/libemf-1.0.4-r1.ebuild           | 37 ---------
 media-libs/libemf/libemf-1.0.7.ebuild              | 35 --------
 5 files changed, 195 deletions(-)