CVE-2006-3376
published 2006-07-06CVE-2006-3376: Integer overflow in player.c in libwmf 0.2.8.4, as used in multiple products including (1) wv, (2) abiword, (3) freetype, (4) gimp, (5) libgsf, and (6)…
PriorityP337high7.5CVSS 2.0
AVNACLAuNCPIPAP
EPSS
7.75%
94.0th percentile
Integer overflow in player.c in libwmf 0.2.8.4, as used in multiple products including (1) wv, (2) abiword, (3) freetype, (4) gimp, (5) libgsf, and (6) imagemagick allows remote attackers to execute arbitrary code via the MaxRecordSize header field in a WMF file.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | libwmf | < libwmf 0.2.8.4-2 (bookworm) | libwmf 0.2.8.4-2 (bookworm) |
| wvware | libwmf | — | — |
| wvware | libwmf | >= 0 < 0.2.8.4-2 | 0.2.8.4-2 |
| wvware | libwmf | >= 0 < 0.2.8.4-2 | 0.2.8.4-2 |
| wvware | libwmf | >= 0 < 0.2.8.4-2 | 0.2.8.4-2 |
| wvware | libwmf | >= 0 < 0.2.8.4-2 | 0.2.8.4-2 |
| wvware | wv2 | — | — |
| wvware | wv2 | — | — |
| wvware | wv2 | — | — |
CVSS provenance
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv7.5HIGH
vendor_debian7.5MEDIUM
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
libwmf vulnerability
vendor_ubuntu·2006-08-09
CVE-2006-3376 libwmf vulnerability
Title: libwmf vulnerability
Summary: libwmf vulnerability
An integer overflow was found in the handling of the MaxRecordSize
field in the WMF header parser. By tricking a user into opening a
specially crafted WMF image file with an application that uses this
library, an attacker could exploit this to execute arbitrary code with
the user's privileges.
Instructions: In general, a standard system upgrade is sufficient to effect the
necessary changes.
Red Hat
security flaw
vendor_redhat·2006-06-30·CVSS 7.5
CVE-2006-3376 [HIGH] security flaw
security flaw
Integer overflow in player.c in libwmf 0.2.8.4, as used in multiple products including (1) wv, (2) abiword, (3) freetype, (4) gimp, (5) libgsf, and (6) imagemagick allows remote attackers to execute arbitrary code via the MaxRecordSize header field in a WMF file.
Statement: Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.
Debian
CVE-2006-3376: libwmf - Integer overflow in player.c in libwmf 0.2.8.4, as used in multiple products inc...
vendor_debian·2006·CVSS 7.5
CVE-2006-3376 [HIGH] CVE-2006-3376: libwmf - Integer overflow in player.c in libwmf 0.2.8.4, as used in multiple products inc...
Integer overflow in player.c in libwmf 0.2.8.4, as used in multiple products including (1) wv, (2) abiword, (3) freetype, (4) gimp, (5) libgsf, and (6) imagemagick allows remote attackers to execute arbitrary code via the MaxRecordSize header field in a WMF file.
Scope: local
bookworm: resolved (fixed in 0.2.8.4-2)
bullseye: resolved (fixed in 0.2.8.4-2)
forky: resolved (fixed in 0.2.8.4-2)
sid: resolved (fixed in 0.2.8.4-2)
trixie: resolved (fixed in 0.2.8.4-2)
GHSA
GHSA-gm5p-fx2g-h9h3: Integer overflow in player
ghsa_unreviewed·2022-05-01
CVE-2006-3376 [HIGH] GHSA-gm5p-fx2g-h9h3: Integer overflow in player
Integer overflow in player.c in libwmf 0.2.8.4, as used in multiple products including (1) wv, (2) abiword, (3) freetype, (4) gimp, (5) libgsf, and (6) imagemagick allows remote attackers to execute arbitrary code via the MaxRecordSize header field in a WMF file.
OSV
CVE-2006-3376: Integer overflow in player
osv·2006-07-06·CVSS 7.5
CVE-2006-3376 [HIGH] CVE-2006-3376: Integer overflow in player
Integer overflow in player.c in libwmf 0.2.8.4, as used in multiple products including (1) wv, (2) abiword, (3) freetype, (4) gimp, (5) libgsf, and (6) imagemagick allows remote attackers to execute arbitrary code via the MaxRecordSize header field in a WMF file.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2006-3376 security flaw
bugzilla·2018-08-16·CVSS 7.5
CVE-2006-3376 [HIGH] CVE-2006-3376 security flaw
CVE-2006-3376 security flaw
Flaw bug created to hold information about an old flaw we knew something about. For more details see the MITRE CVE description.
Discussion:
MITRE description:
Integer overflow in player.c in libwmf 0.2.8.4, as used in multiple products including (1) wv, (2) abiword, (3) freetype, (4) gimp, (5) libgsf, and (6) imagemagick allows remote attackers to execute arbitrary code via the MaxRecordSize header field in a WMF file.
---
Statement:
Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.
Bugzilla
CVE-2006-3376 libwmf integer overflow
bugzilla·2006-07-10·CVSS 7.5
CVE-2006-3376 [HIGH] CVE-2006-3376 libwmf integer overflow
CVE-2006-3376 libwmf integer overflow
libwmf integer overflow
infamous41md discovered an integer overflow bug in libwmf.
There is more information here:
http://www.securityfocus.com/archive/1/archive/1/438803/100/0/threaded
Discussion:
Created attachment 132225
maybe this will suffice
---
Created attachment 132312
testcase
I don't have a proper test case, but here's a wmf which has a size field which
will overflow as reported above on a box where size_t is 32. With the fix in
place it shouldn't open on such a system.
---
built and mkerrata-wrapper dist-4E-errata-candidate libwmf-0.2.8.3-5.2 has been run.
The attached .wmf shouldn't open on 32bit platforms after this change, but
normal .wmf's should
---
RHSA-2006:0597 in progress.
---
Created attachment 132425
maybe a better
Bugzilla
CVE-2006-3376 libwmf integer overflow
bugzilla·2006-07-10·CVSS 7.5
CVE-2006-3376 [HIGH] CVE-2006-3376 libwmf integer overflow
CVE-2006-3376 libwmf integer overflow
libwmf integer overflow
infamous41md discovered an integer overflow bug in libwmf.
There is more information here:
http://www.securityfocus.com/archive/1/archive/1/438803/100/0/threaded
This issue also affects FC4
Discussion:
errata have been issued
http://rhn.redhat.com/errata/RHSA-2006-0597.htmlhttp://secunia.com/advisories/20921http://secunia.com/advisories/21064http://secunia.com/advisories/21261http://secunia.com/advisories/21419http://secunia.com/advisories/21459http://secunia.com/advisories/21473http://secunia.com/advisories/22311http://security.gentoo.org/glsa/glsa-200608-17.xmlhttp://securityreason.com/securityalert/1190http://securitytracker.com/id?1016518http://www.mandriva.com/security/advisories?name=MDKSA-2006:132http://www.novell.com/linux/security/advisories/2006_19_sr.htmlhttp://www.securityfocus.com/archive/1/438803/100/0/threadedhttp://www.securityfocus.com/bid/18751http://www.ubuntu.com/usn/usn-333-1http://www.vupen.com/english/advisories/2006/2646https://exchange.xforce.ibmcloud.com/vulnerabilities/27516https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10262https://www.debian.org/security/2006/dsa-1194http://rhn.redhat.com/errata/RHSA-2006-0597.htmlhttp://secunia.com/advisories/20921http://secunia.com/advisories/21064http://secunia.com/advisories/21261http://secunia.com/advisories/21419http://secunia.com/advisories/21459http://secunia.com/advisories/21473http://secunia.com/advisories/22311http://security.gentoo.org/glsa/glsa-200608-17.xmlhttp://securityreason.com/securityalert/1190http://securitytracker.com/id?1016518http://www.mandriva.com/security/advisories?name=MDKSA-2006:132http://www.novell.com/linux/security/advisories/2006_19_sr.htmlhttp://www.securityfocus.com/archive/1/438803/100/0/threadedhttp://www.securityfocus.com/bid/18751http://www.ubuntu.com/usn/usn-333-1http://www.vupen.com/english/advisories/2006/2646https://exchange.xforce.ibmcloud.com/vulnerabilities/27516https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10262https://www.debian.org/security/2006/dsa-1194
2006-07-06
Published