CVE-2009-1364
published 2009-05-01CVE-2009-1364: Use-after-free vulnerability in the embedded GD library in libwmf 0.2.8.4 allows context-dependent attackers to cause a denial of service (application crash)…
PriorityP431high7.5CVSS 2.0
AVNACLAuNCPIPAP
EPSS
3.46%
87.7th percentile
Use-after-free vulnerability in the embedded GD library in libwmf 0.2.8.4 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted WMF file.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | libwmf | < libwmf 0.2.8.4-6.1 (bookworm) | libwmf 0.2.8.4-6.1 (bookworm) |
| francis_james_franklin | libwmf | — | — |
| opensuse | opensuse | — | — |
| opensuse | opensuse | — | — |
| wvware | libwmf | >= 0 < 0.2.8.4-6.1 | 0.2.8.4-6.1 |
| wvware | libwmf | >= 0 < 0.2.8.4-6.1 | 0.2.8.4-6.1 |
| wvware | libwmf | >= 0 < 0.2.8.4-6.1 | 0.2.8.4-6.1 |
| wvware | libwmf | >= 0 < 0.2.8.4-6.1 | 0.2.8.4-6.1 |
CVSS provenance
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv7.5HIGH
vendor_debian7.5LOW
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
libwmf vulnerability
vendor_ubuntu·2009-05-04
CVE-2009-1364 libwmf vulnerability
Title: libwmf vulnerability
Summary: libwmf vulnerability
Tavis Ormandy discovered that libwmf incorrectly used memory after it had
been freed when using its embedded GD library. If a user or automated
system were tricked into opening a crafted WMF file, an attacker could
cause a denial of service or execute arbitrary code with privileges of the
user invoking the program.
Instructions: In general, a standard system upgrade is sufficient to effect the
necessary changes.
Red Hat
libwmf: embedded gd use-after-free error
vendor_redhat·2009-04-27·CVSS 7.5
CVE-2009-1364 [HIGH] CWE-416 libwmf: embedded gd use-after-free error
libwmf: embedded gd use-after-free error
Use-after-free vulnerability in the embedded GD library in libwmf 0.2.8.4 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted WMF file.
Debian
CVE-2009-1364: libwmf - Use-after-free vulnerability in the embedded GD library in libwmf 0.2.8.4 allows...
vendor_debian·2009·CVSS 7.5
CVE-2009-1364 [HIGH] CVE-2009-1364: libwmf - Use-after-free vulnerability in the embedded GD library in libwmf 0.2.8.4 allows...
Use-after-free vulnerability in the embedded GD library in libwmf 0.2.8.4 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted WMF file.
Scope: local
bookworm: resolved (fixed in 0.2.8.4-6.1)
bullseye: resolved (fixed in 0.2.8.4-6.1)
forky: resolved (fixed in 0.2.8.4-6.1)
sid: resolved (fixed in 0.2.8.4-6.1)
trixie: resolved (fixed in 0.2.8.4-6.1)
GHSA
GHSA-6h8h-vx9v-4g94: Use-after-free vulnerability in the embedded GD library in libwmf 0
ghsa_unreviewed·2022-05-02
CVE-2009-1364 [HIGH] GHSA-6h8h-vx9v-4g94: Use-after-free vulnerability in the embedded GD library in libwmf 0
Use-after-free vulnerability in the embedded GD library in libwmf 0.2.8.4 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted WMF file.
OSV
CVE-2009-1364: Use-after-free vulnerability in the embedded GD library in libwmf 0
osv·2009-05-01·CVSS 7.5
CVE-2009-1364 [HIGH] CVE-2009-1364: Use-after-free vulnerability in the embedded GD library in libwmf 0
Use-after-free vulnerability in the embedded GD library in libwmf 0.2.8.4 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted WMF file.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2009-1364 libwmf: embedded gd use-after-free error
bugzilla·2009-05-26·CVSS 7.5
CVE-2009-1364 [HIGH] CVE-2009-1364 libwmf: embedded gd use-after-free error
CVE-2009-1364 libwmf: embedded gd use-after-free error
This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in all affected branches.
For comments that are specific to the vulnerability please use bugs filed against "Security Response" product referenced in "Blocks" field.
bug #496864: CVE-2009-1364 libwmf: embedded gd use-after-free error
When creating a Bodhi update request, please include the bug IDs of the respective parent bugs filed against the "Security Response" product.
Please mention CVE ids in the RPM changelog when available and only close this bug once all affected Fedora versions are fixed.
Bodhi update submission link:
https://admin.fedoraproject.org/updates/new/?type_=security&bugs=496864
Discussi
Bugzilla
CVE-2009-1364 libwmf: embedded gd use-after-free error
bugzilla·2009-04-21·CVSS 7.5
CVE-2009-1364 [HIGH] CVE-2009-1364 libwmf: embedded gd use-after-free error
CVE-2009-1364 libwmf: embedded gd use-after-free error
Tavis Ormandy reported a use-after-free error affecing liwmf library. Flaw
exists in gdClipSetAdd in src/extra/gd/gd_clip.c.
69 if (im->clip->count == im->clip->max)
70 { more = gdRealloc (im->clip->list,(im->clip->max + 8) *
sizeof (gdClipRectangle));
71 if (more == 0) return;
72 im->clip->max += 8;
73 }
more returned by gdRealloc (wrapper around standard realloc) is not assigned to
im->clip->list as it should, im->clip->list may point to memory no longer used
or allocated to something else.
Acknowledgements:
Red Hat would like to thank Tavis Ormandy of the Google Security Team for
responsibly reporting this flaw.
Discussion:
According to libwmf upstream CVS:
http://wvware.cvs.sourceforge.net/viewvc/wvware/libwmf2/src/extra/gd/
http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.htmlhttp://lists.opensuse.org/opensuse-updates/2015-06/msg00051.htmlhttp://lists.opensuse.org/opensuse-updates/2015-06/msg00053.htmlhttp://rhn.redhat.com/errata/RHSA-2009-0457.htmlhttp://secunia.com/advisories/34901http://secunia.com/advisories/34964http://secunia.com/advisories/35001http://secunia.com/advisories/35025http://secunia.com/advisories/35190http://secunia.com/advisories/35416http://secunia.com/advisories/35686http://security.gentoo.org/glsa/glsa-200907-01.xmlhttp://wvware.cvs.sourceforge.net/viewvc/wvware/libwmf2/src/extra/Makefile.am?hideattic=0&view=loghttp://www.debian.org/security/2009/dsa-1796http://www.mandriva.com/security/advisories?name=MDVSA-2009:106http://www.securityfocus.com/bid/34792http://www.securitytracker.com/id?1022154http://www.ubuntu.com/usn/USN-769-1http://www.vupen.com/english/advisories/2009/1228https://bugzilla.redhat.com/show_bug.cgi?id=496864https://exchange.xforce.ibmcloud.com/vulnerabilities/50290https://launchpad.net/bugs/cve/2009-1364https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10959https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01263.htmlhttps://www.redhat.com/archives/fedora-package-announce/2009-May/msg01266.htmlhttps://www.redhat.com/archives/fedora-package-announce/2009-May/msg01269.htmlhttp://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.htmlhttp://lists.opensuse.org/opensuse-updates/2015-06/msg00051.htmlhttp://lists.opensuse.org/opensuse-updates/2015-06/msg00053.htmlhttp://rhn.redhat.com/errata/RHSA-2009-0457.htmlhttp://secunia.com/advisories/34901http://secunia.com/advisories/34964http://secunia.com/advisories/35001http://secunia.com/advisories/35025http://secunia.com/advisories/35190http://secunia.com/advisories/35416http://secunia.com/advisories/35686http://security.gentoo.org/glsa/glsa-200907-01.xmlhttp://wvware.cvs.sourceforge.net/viewvc/wvware/libwmf2/src/extra/Makefile.am?hideattic=0&view=loghttp://www.debian.org/security/2009/dsa-1796http://www.mandriva.com/security/advisories?name=MDVSA-2009:106http://www.securityfocus.com/bid/34792http://www.securitytracker.com/id?1022154http://www.ubuntu.com/usn/USN-769-1http://www.vupen.com/english/advisories/2009/1228https://bugzilla.redhat.com/show_bug.cgi?id=496864https://exchange.xforce.ibmcloud.com/vulnerabilities/50290https://launchpad.net/bugs/cve/2009-1364https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10959https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01263.htmlhttps://www.redhat.com/archives/fedora-package-announce/2009-May/msg01266.htmlhttps://www.redhat.com/archives/fedora-package-announce/2009-May/msg01269.html
2009-05-01
Published