OpenOffice.org: EMF/WMF file handling vulnerabilities

Background OpenOffice.org is an open source office productivity suite, including word processing, spreadsheet, presentation, drawing, data charting, formula editing, and file conversion facilities. Description John Heasman of NGSSoftware has discovered integer overflows in the EMRPOLYPOLYGON and...

OpenOffice fails to properly process WMF and EMF files

Overview Multiple buffer overflow vulnerabilities exist in the OpenOffice.org office suite. If successfully exploited, these vulnerabilities may allow an attacker to execute arbitrary code on a vulnerable system. Description OpenOffice.org is a free office suite that is available for multiple...

CVE-2006-5870

CVE-2006-5870 affects OpenOffice.org 2.0.4 and earlier and StarOffice 6–8, enabling user-assisted remote code execution via crafted WMF/EMF files that trigger heap-based overflows during META_ESCAPE and EMR_POLYPOLYGON processing. Connected advisories (e.g., RHSA-2007:0001) confirm a backported f...

CVE-2006-5870

Multiple integer overflows in OpenOffice.org OOo 2.0.4 and earlier, and possibly other versions before 2.1.0; and StarOffice 6 through 8; allow user-assisted remote attackers to execute arbitrary code via a crafted a WMF or b EMF file that triggers heap-based buffer overflows in 1 wmf/winwmf.cxx,...

OpenOffice buffer overflow

Integer overflow leads to heap buffer overflow on EMF/WMF files parsing...

CVE-2006-4727

Cross-site scripting XSS vulnerability in emfadmin/statusView.do in Tumbleweed EMF Administration Module 6.2.2 Build 4123, and possibly other versions before 6.3.2, allows remote attackers to inject arbitrary web script or HTML via the 1 lineId and 2 sort parameters...

CVE-2006-5870

Multiple integer overflows in OpenOffice.org OOo 2.0.4 and earlier, and possibly other versions before 2.1.0; and StarOffice 6 through 8; allow user-assisted remote attackers to execute arbitrary code via a crafted a WMF or b EMF file that triggers heap-based buffer overflows in 1 wmf/winwmf.cxx,...

PT-2006-5347 · Canyon +3 · Canyon Power File Gold +5

Name of the Vulnerable Software and Affected Versions: BeCubed Compression Plus versions prior to 5.0.1.28 Tumbleweed EMF versions prior to 5.0.1.28 VCOM/Ontrack PowerDesk Pro versions prior to 5.0.1.28 Canyon Drag and Zip versions prior to 5.0.1.28 Canyon Power File versions prior to 5.0.1.28...

CVE-2006-4554

Stack-based buffer overflow in the ReadFile function in the ZOO-processing exports in the BeCubed Compression Plus before 5.0.1.28, as used in products including 1 Tumbleweed EMF, 2 VCOM/Ontrack PowerDesk Pro, 3 Canyon Drag and Zip, 4 Canyon Power File, and 5 Canyon Power File Gold, allow...

Integer overflow

Integer overflow in the PolyPolygon function in Graphics Rendering Engine on Microsoft Windows 98 and Me allows remote attackers to execute arbitrary code via a Windows Metafile WMF or EMF image with a sum of entries in the vertext counts array and number of polygons that triggers a heap-based...

CVE-2006-2376

Integer overflow in the PolyPolygon function in Graphics Rendering Engine on Microsoft Windows 98 and Me allows remote attackers to execute arbitrary code via a Windows Metafile WMF or EMF image with a sum of entries in the vertext counts array and number of polygons that triggers a heap-based...

CVE-2006-2376

Integer overflow in the PolyPolygon function in Graphics Rendering Engine on Microsoft Windows 98 and Me allows remote attackers to execute arbitrary code via a Windows Metafile WMF or EMF image with a sum of entries in the vertext counts array and number of polygons that triggers a heap-based...

Microsoft Windows GDI WMF Handling Heap Overflow Vulnerability

Description The Microsoft Windows GDI Graphics Rendering Engine is prone to a heap-overflow vulnerability. This issue is exposed when the component loads a specially crafted WMF Windows Metafile image. If this issue is exploited, a malicious WMF or EMF file could potentially corrupt heap-based...

WMF and EMF Files (CVE-2005-2123; CVE-2005-2124; CVE-2005-4560; CVE-2006-0020)

...

CVE-2006-0487

Technical details for CVE-2006-0487 are not publicly available in the provided documents. No concrete information on affected components, root cause, or remediation is supplied here; monitor for updates.

CVE-2005-2123

Multiple integer overflows in the Graphics Rendering Engine GDI32.DLL in Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 allow remote attackers to execute arbitrary code via crafted Windows Metafile WMF and Enhanced Metafile EMF format images that lead to heap-based buffer overflows, as...

CVE-2005-2123

Multiple integer overflows in the Graphics Rendering Engine GDI32.DLL in Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 allow remote attackers to execute arbitrary code via crafted Windows Metafile WMF and Enhanced Metafile EMF format images that lead to heap-based buffer overflows, as...

CVE-2005-2123

CVE-2005-2123 affects the Windows GDI32.DLL Graphics Rendering Engine, with heap-based buffer overflows triggered by crafted WMF/EMF image data. Affected systems include Windows 2000 SP4, XP SP1/SP2, and Server 2003 SP1. Root cause is overflow/unchecked size handling in image rendering, enabling ...

Microsoft Windows WMF / EMF buffer overflow

Multiple buffer overflows in GDI on WMF and WMF windows metafile formats...

Microsoft Windows buffer overflow in Enhanced Metafile rendering API

Overview Microsoft Windows Enhanced Metafile Format image rendering routines contain a buffer overflow flaw that may allow an attacker to cause a denial-of-service condition. Description Microsoft describes the Enhanced Metafile Format EMF as the following:An EMF image is a 32-bit format that can...