oss-sec mailing list archives
Re: CVE-2015-0848 - Heap overflow on libwmf0.2-7
From: Stefan Cornelius <scorneli () redhat com>
Date: Wed, 3 Jun 2015 13:10:43 +0200
On Mon, 1 Jun 2015 03:06:57 -0500 Fernando Muñoz <fernando () null-life com> wrote:
libwmf is affected by a heap overflow on the function that decodes BMP images. WMF files may contain both vector graphics and bitmap components. With the attached WMF file, the issue can be reproduced, an overflow happens because image_size gets a value of 32, that space is used to allocate data->image
There's another issue related to the RLE decoding. DecodeImage() does not check that the run-length "count" fits into the total size of the image, which can lead to a heap-based buffer overflow. I've not assigned a CVE ID to this (mainly because I'm not sure if this warrants a new CVE or should be bundled with CVE-2015-0848, so I leave that up to the CVE experts on the list). We have some possible fixes in our bug [1], but be cautious - these are not fully vetted yet. So far, however, they look fine to me. [1] https://bugzilla.redhat.com/show_bug.cgi?id=1227243 -- Stefan Cornelius / Red Hat Product Security Come talk to Red Hat Product Security at the Summit! Red Hat Summit 2015 - https://www.redhat.com/summit/
Current thread:
- CVE-2015-0848 - Heap overflow on libwmf0.2-7 Fernando Muñoz (Jun 01)
- Re: CVE-2015-0848 - Heap overflow on libwmf0.2-7 Alessandro Ghedini (Jun 01)
- Re: CVE-2015-0848 - Heap overflow on libwmf0.2-7 Stefan Cornelius (Jun 03)
- Re: CVE-2015-0848 - Heap overflow on libwmf0.2-7 Stefan Cornelius (Jun 15)
- Re: CVE-2015-0848 - Heap overflow on libwmf0.2-7 cve-assign (Jun 15)
- Re: CVE-2015-0848 - Heap overflow on libwmf0.2-7 Fernando Muñoz (Jun 16)
- Re: CVE-2015-0848 - Heap overflow on libwmf0.2-7 cve-assign (Jun 21)