Use-after-free vulnerability in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (crash) via a crafted WMF file to the (1) wmf2gd or (2) wmf2eps command.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - gd: additional overflows (CVE-2004-0941)

  - libwmf: Memory allocation failure in wmf_malloc (CVE-2016-9011)

  - Buffer overflow in the gdImageStringFTEx function in gdft.c in GD Graphics Library 2.0.33 and earlier     allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary     code via a crafted string with a JIS encoded font. (CVE-2007-0455)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

New libwmf packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, 14.2, and -current to fix security issues.

The remote host is affected by the vulnerability described in GLSA-201602-03 (libwmf: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in libwmf.  Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process or cause Denial of Service.
  Workaround :

    There is no known work around at this time.

It was discovered that libwmf did not correctly process certain WMF (Windows Metafiles) with embedded BMP images. By tricking a victim into opening a specially crafted WMF file in an application using libwmf, a remote attacker could possibly use this flaw to execute arbitrary code with the privileges of the user running the application. (CVE-2015-0848 , CVE-2015-4588)

It was discovered that libwmf did not properly process certain WMF files. By tricking a victim into opening a specially crafted WMF file in an application using libwmf, a remote attacker could possibly exploit this flaw to cause a crash or execute arbitrary code with the privileges of the user running the application. (CVE-2015-4696)

It was discovered that libwmf did not properly process certain WMF files. By tricking a victim into opening a specially crafted WMF file in an application using libwmf, a remote attacker could possibly exploit this flaw to cause a crash. (CVE-2015-4695)

The gdPngReadData function in libgd 2.0.34 allows user-assisted attackers to cause a denial of service (CPU consumption) via a crafted PNG image with truncated data, which causes an infinite loop in the png_read_info function in libpng. (CVE-2007-2756)

Buffer overflow in the gdImageStringFTEx function in gdft.c in GD Graphics Library 2.0.33 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted string with a JIS encoded font. (CVE-2007-0455)

The _gdGetColors function in gd_gd.c in PHP 5.2.11 and 5.3.x before 5.3.1, and the GD Graphics Library 2.x, does not properly verify a certain colorsTotal structure member, which might allow remote attackers to conduct buffer overflow or buffer over-read attacks via a crafted GD file, a different vulnerability than CVE-2009-3293 . NOTE:
some of these details are obtained from third party information.
(CVE-2009-3546)

Integer overflow in gdImageCreateTrueColor function in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to have unspecified attack vectors and impact. (CVE-2007-3472)

The gdImageCreateXbm function in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash) via unspecified vectors involving a gdImageCreate failure. (CVE-2007-3473)

It was discovered that libwmf did not correctly process certain WMF (Windows Metafiles) with embedded BMP images. By tricking a victim into opening a specially crafted WMF file in an application using libwmf, a remote attacker could possibly use this flaw to execute arbitrary code with the privileges of the user running the application. (CVE-2015-0848, CVE-2015-4588)

It was discovered that libwmf did not properly process certain WMF files. By tricking a victim into opening a specially crafted WMF file in an application using libwmf, a remote attacker could possibly exploit this flaw to cause a crash or execute arbitrary code with the privileges of the user running the application. (CVE-2015-4696)

It was discovered that libwmf did not properly process certain WMF files. By tricking a victim into opening a specially crafted WMF file in an application using libwmf, a remote attacker could possibly exploit this flaw to cause a crash. (CVE-2015-4695)

After installing the update, all applications using libwmf must be restarted for the update to take effect.

Updated libwmf packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6 and 7.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

libwmf is a library for reading and converting Windows Metafile Format (WMF) vector graphics. libwmf is used by applications such as GIMP and ImageMagick.

It was discovered that libwmf did not correctly process certain WMF (Windows Metafiles) with embedded BMP images. By tricking a victim into opening a specially crafted WMF file in an application using libwmf, a remote attacker could possibly use this flaw to execute arbitrary code with the privileges of the user running the application. (CVE-2015-0848, CVE-2015-4588)

It was discovered that libwmf did not properly process certain WMF files. By tricking a victim into opening a specially crafted WMF file in an application using libwmf, a remote attacker could possibly exploit this flaw to cause a crash or execute arbitrary code with the privileges of the user running the application. (CVE-2015-4696)

It was discovered that libwmf did not properly process certain WMF files. By tricking a victim into opening a specially crafted WMF file in an application using libwmf, a remote attacker could possibly exploit this flaw to cause a crash. (CVE-2015-4695)

All users of libwmf are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing the update, all applications using libwmf must be restarted for the update to take effect.

From Red Hat Security Advisory 2015:1917 :

Updated libwmf packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6 and 7.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

libwmf is a library for reading and converting Windows Metafile Format (WMF) vector graphics. libwmf is used by applications such as GIMP and ImageMagick.

It was discovered that libwmf did not correctly process certain WMF (Windows Metafiles) with embedded BMP images. By tricking a victim into opening a specially crafted WMF file in an application using libwmf, a remote attacker could possibly use this flaw to execute arbitrary code with the privileges of the user running the application. (CVE-2015-0848, CVE-2015-4588)

It was discovered that libwmf did not properly process certain WMF files. By tricking a victim into opening a specially crafted WMF file in an application using libwmf, a remote attacker could possibly exploit this flaw to cause a crash or execute arbitrary code with the privileges of the user running the application. (CVE-2015-4696)

It was discovered that libwmf did not properly process certain WMF files. By tricking a victim into opening a specially crafted WMF file in an application using libwmf, a remote attacker could possibly exploit this flaw to cause a crash. (CVE-2015-4695)

All users of libwmf are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing the update, all applications using libwmf must be restarted for the update to take effect.

libwmf was updated to fix five security issues.

These security issues were fixed :

  - CVE-2009-1364: Fixed realloc return value usage     (bsc#495842, bnc#831299)

  - CVE-2015-0848: Heap overflow on libwmf0.2-7 (bsc#933109)

  - CVE-2015-4588: DecodeImage() did not check that the     run-length 'count' fits into the total size of the     image, which could lead to a heap-based buffer overflow     (bsc#933109)

  - CVE-2015-4695: meta_pen_create heap buffer over read     (bsc#936058)

  - CVE-2015-4696: Use after free (bsc#936062)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

libwmf was updated to fix four security issues.

These security issues were fixed :

  - CVE-2015-4588: Heap-based buffer overflow in the     DecodeImage function allowed remote attackers to cause a     denial of service (crash) or possibly execute arbitrary     code via a crafted 'run-length count' in an image in a     WMF file (bsc#933109).

  - CVE-2015-0848: Heap-based buffer overflow allowed remote     attackers to cause a denial of service (crash) or     possibly execute arbitrary code via a crafted BMP image     (bsc#933109).

  - CVE-2015-4696: Use-after-free vulnerability allowed     remote attackers to cause a denial of service (crash)     via a crafted WMF file to the (1) wmf2gd or (2) wmf2eps     command (bsc#936062).

  - CVE-2015-4695: meta.h allowed remote attackers to cause     a denial of service (out-of-bounds read) via a crafted     WMF file (bsc#936058).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

CVE-2015-0848 Heap overflow CVE-2015-4588 RLE decoding doesn't check that the 'count' fits into the image CVE-2015-4695 meta_pen_create heap buffer overflow CVE-2015-4696 wmf2gd/wmf2eps use after free

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Mitre reports :

Multiple buffer overflows in the gd graphics library (libgd) 2.0.21 and earlier may allow remote attackers to execute arbitrary code via malformed image files that trigger the overflows due to improper calls to the gdMalloc function, a different set of vulnerabilities than CVE-2004-0990.

Buffer overflow in the gdImageStringFTEx function in gdft.c in GD Graphics Library 2.0.33 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted string with a JIS encoded font.

The gdPngReadData function in libgd 2.0.34 allows user-assisted attackers to cause a denial of service (CPU consumption) via a crafted PNG image with truncated data, which causes an infinite loop in the png_read_info function in libpng.

Integer overflow in gdImageCreateTrueColor function in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to have unspecified attack vectors and impact.

The gdImageCreateXbm function in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash) via unspecified vectors involving a gdImageCreate failure.

The (a) imagearc and (b) imagefilledarc functions in GD Graphics Library (libgd) before 2.0.35 allow attackers to cause a denial of service (CPU consumption) via a large (1) start or (2) end angle degree value.

The _gdGetColors function in gd_gd.c in PHP 5.2.11 and 5.3.x before 5.3.1, and the GD Graphics Library 2.x, does not properly verify a certain colorsTotal structure member, which might allow remote attackers to conduct buffer overflow or buffer over-read attacks via a crafted GD file, a different vulnerability than CVE-2009-3293. NOTE:
some of these details are obtained from third party information.

Heap-based buffer overflow in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted BMP image.

meta.h in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WMF file.

Use-after-free vulnerability in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (crash) via a crafted WMF file to the (1) wmf2gd or (2) wmf2eps command.

Heap-based buffer overflow in the DecodeImage function in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted 'run-length count' in an image in a WMF file.

CVE-2015-0848 heap overflow when decoding BMP images CVE-2015-4588 RLE decoding doesn't check that the 'count' fits into the image CVE-2015-4695 meta_pen_create heap buffer overflow CVE-2015-4696 wmf2gd/wmf2eps use after free

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

libwmf was updated to fix four security issues.

These security issues were fixed :

  - CVE-2015-4588: Heap overflow (bnc#933109).

  - CVE-2015-4696: Use after free (bnc#936062).

  - CVE-2015-4695: Heap buffer over read (bnc#936058).

  - CVE-2015-0848: Heap overflow (bnc#933109).

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2670-1 advisory.

    Fernando Muoz and Stefan Cornelius discovered that libwmf incorrectly handled certain malformed images.
    If a user or automated system were tricked into opening a crafted image file, an attacker could cause a     denial of service or execute arbitrary code with privileges of the user invoking the program.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Insufficient input sanitising in libwmf, a library to process Windows metafile data, may result in denial of service or the execution of arbitrary code if a malformed WMF file is opened.

libwmf is vulnerable to two denial of service due to invalid read operations when processing specially crafted WMF files.

CVE-2015-4695

Heap buffer overread in libwmf

CVE-2015-4696

Read after free() in wmf2gd/wmf2eps

For the squeeze distribution, those issues have been fixed in libwmf 0.2.8.4-6.2+deb6u2. We recommend that you upgrade your libwmf packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
198402	RHEL 5 : libwmf (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
109432	Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / 14.2 / current : libwmf (SSA:2018-120-01)	Nessus	Slackware Local Security Checks	high
103586	GLSA-201602-03 : libwmf: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
86635	Amazon Linux AMI : libwmf (ALAS-2015-604)	Nessus	Amazon Linux Local Security Checks	high
86489	Scientific Linux Security Update : libwmf on SL6.x, SL7.x i386/x86_64 (20151020)	Nessus	Scientific Linux Local Security Checks	medium
86488	RHEL 6 / 7 : libwmf (RHSA-2015:1917)	Nessus	Red Hat Local Security Checks	medium
86487	Oracle Linux 6 / 7 : libwmf (ELSA-2015-1917)	Nessus	Oracle Linux Local Security Checks	medium
86485	CentOS 6 / 7 : libwmf (CESA-2015:1917)	Nessus	CentOS Local Security Checks	medium
85796	SUSE SLED12 Security Update : libwmf (SUSE-SU-2015:1484-1)	Nessus	SuSE Local Security Checks	high
85399	SUSE SLED11 Security Update : libwmf (SUSE-SU-2015:1378-1)	Nessus	SuSE Local Security Checks	medium
85084	Fedora 21 : libwmf-0.2.8.4-45.fc21 (2015-10601)	Nessus	Fedora Local Security Checks	medium
84782	FreeBSD : libwmf -- multiple vulnerabilities (ca139c7f-2a8c-11e5-a4a5-002590263bf5)	Nessus	FreeBSD Local Security Checks	critical
84679	Fedora 22 : libwmf-0.2.8.4-45.fc22 (2015-10627)	Nessus	Fedora Local Security Checks	medium
84656	openSUSE Security Update : libwmf (openSUSE-2015-477)	Nessus	SuSE Local Security Checks	medium
84635	Ubuntu 14.04 LTS : libwmf vulnerabilities (USN-2670-1)	Nessus	Ubuntu Local Security Checks	high
84552	Debian DSA-3302-1 : libwmf - security update	Nessus	Debian Local Security Checks	medium
84435	Debian DLA-257-1 : libwmf security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2015-4696

medium

Tenable Plugins

medium

high

medium

high

medium

medium

medium

medium

high

medium

medium

critical

medium

medium

high

medium

medium