[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20150603131043.558df5e8@redhat.com>
Date: Wed, 3 Jun 2015 13:10:43 +0200
From: Stefan Cornelius <scorneli@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE-2015-0848 - Heap overflow on libwmf0.2-7
On Mon, 1 Jun 2015 03:06:57 -0500
Fernando Muñoz <fernando@...l-life.com> wrote:
> libwmf is affected by a heap overflow on the function that decodes
> BMP images.
>
> WMF files may contain both vector graphics and bitmap components. With
> the attached WMF file, the issue can be reproduced, an overflow
> happens because image_size gets a value of 32, that space is used to
> allocate data->image
>
There's another issue related to the RLE decoding. DecodeImage() does
not check that the run-length "count" fits into the total size of the
image, which can lead to a heap-based buffer overflow. I've not
assigned a CVE ID to this (mainly because I'm not sure if this
warrants a new CVE or should be bundled with CVE-2015-0848, so I leave
that up to the CVE experts on the list).
We have some possible fixes in our bug [1], but be cautious - these are
not fully vetted yet. So far, however, they look fine to me.
[1] https://bugzilla.redhat.com/show_bug.cgi?id=1227243
--
Stefan Cornelius / Red Hat Product Security
Come talk to Red Hat Product Security at the Summit!
Red Hat Summit 2015 - https://www.redhat.com/summit/
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
