Date: Wed, 3 Jun 2015 13:10:43 +0200 From: Stefan Cornelius <scorneli@...hat.com> To: oss-security@...ts.openwall.com Subject: Re: CVE-2015-0848 - Heap overflow on libwmf0.2-7 On Mon, 1 Jun 2015 03:06:57 -0500 Fernando Muñoz <fernando@...l-life.com> wrote: > libwmf is affected by a heap overflow on the function that decodes > BMP images. > > WMF files may contain both vector graphics and bitmap components. With > the attached WMF file, the issue can be reproduced, an overflow > happens because image_size gets a value of 32, that space is used to > allocate data->image > There's another issue related to the RLE decoding. DecodeImage() does not check that the run-length "count" fits into the total size of the image, which can lead to a heap-based buffer overflow. I've not assigned a CVE ID to this (mainly because I'm not sure if this warrants a new CVE or should be bundled with CVE-2015-0848, so I leave that up to the CVE experts on the list). We have some possible fixes in our bug , but be cautious - these are not fully vetted yet. So far, however, they look fine to me.  https://bugzilla.redhat.com/show_bug.cgi?id=1227243 -- Stefan Cornelius / Red Hat Product Security Come talk to Red Hat Product Security at the Summit! Red Hat Summit 2015 - https://www.redhat.com/summit/
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.