libwmf: Buffer overflow vulnerability

Background libwmf is a library for reading and converting vector images in Microsoft's native Windows Metafile Format WMF. Description infamous41md discovered that libwmf fails to do proper bounds checking on the MaxRecordSize variable in the WMF file header. This could lead to an head-based buff...

USN-333-1: libwmf vulnerability

An integer overflow was found in the handling of the MaxRecordSize field in the WMF header parser. By tricking a user into opening a specially crafted WMF image file with an application that uses this library, an attacker could exploit this to execute arbitrary code with the user's privileges...

Microsoft Windows GDI32 library integer overflow

CreateBrushInderect integer overflow on WMF files parsing...

[Full-disclosure] 0-day XP SP2 wmf exploit

Description: yet another 'windows meta file' WMF denial of service exploit. System affected: + Windows XP SP2, + Windows 2003 SP1, + Windows XP SP1, + Windows XP + Windows 2003 Tech info: page fault in gdi32!CreateBrushIndirect because invalid pointer access. Incorrect short to void sign extensio...

[Full-disclosure] 0-day XP SP2 wmf exploit (some details)

There is some details for wannabees : 1. 'Bad' wmf record: 07 00 00 00 length of record in words FC 02 type CreateBrushIndirect 08 00 00 00 00 00 00 80 'packed' good old Win16 days LOGBRUSH data: 08 00 - 'packed' lpStyle may be BSDIBPATTERNPT 6 or BSDIBPATTERN8X8 8 00 00 00 00 - COLORREF any 00 8...

RHEL 4 : libwmf (RHSA-2006:0597)

Updated libwmf packages that fix a security flaw are now available for Red Hat Enterprise Linux 4. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Libwmf is a library for reading and converting Windows MetaFile vector graphics WMF. Libwmf is us...

Microsoft Windows XP/2003 Picture and Fax Viewer / Wine / ME code execution

Buffer overflow on parsing WMF metafiles. It may be used for silent Spyware/Trojan installation with Internet Explorer or another browser and also with Lotus Notes. There are vulnerabilities not covered by MS06-001...

SYMSA-2006-004 (Full Details): Vulnerability in Graphics Rendering Engine Could Allow Remote Code Execution

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Symantec Vulnerability Research http://www.symantec.com/research Security Advisory Advisory ID : SYMSA-2006-004 Advisory Title: Vulnerability in Graphics Rendering Engine Could Allow Remote Code Execution Author : Peter Ferrie / [email protected]...

CVE-2006-3376

Integer overflow in player.c in libwmf 0.2.8.4, as used in multiple products including 1 wv, 2 abiword, 3 freetype, 4 gimp, 5 libgsf, and 6 imagemagick allows remote attackers to execute arbitrary code via the MaxRecordSize header field in a WMF file...

CVE-2006-3376

Integer overflow in player.c in libwmf 0.2.8.4, as used in multiple products including 1 wv, 2 abiword, 3 freetype, 4 gimp, 5 libgsf, and 6 imagemagick allows remote attackers to execute arbitrary code via the MaxRecordSize header field in a WMF file...

CVE-2006-3376

Integer overflow in player.c in libwmf 0.2.8.4, as used in multiple products including 1 wv, 2 abiword, 3 freetype, 4 gimp, 5 libgsf, and 6 imagemagick allows remote attackers to execute arbitrary code via the MaxRecordSize header field in a WMF file...

PT-2006-4268 · Linux +1 · Libgsf +7

Name of the Vulnerable Software and Affected Versions: libwmf version 0.2.8.4 Description: The issue is related to an integer overflow in the player.c file of libwmf, which can be exploited by remote attackers to execute arbitrary code. This is achieved through the MaxRecordSize header field in a...

CVE-2006-2376

Integer overflow in the PolyPolygon function in Graphics Rendering Engine on Microsoft Windows 98 and Me allows remote attackers to execute arbitrary code via a Windows Metafile WMF or EMF image with a sum of entries in the vertext counts array and number of polygons that triggers a heap-based...

Preemptive Protection against Graphics Rendering Engine Vulnerability (MS06-026)

A vulnerability exists in the way Microsoft Windows handles specially crafted WMF files. WMF is an image format used in many Windows programs including Internet Explorer and Outlook. By persuading a user to open a specially crafted WMF image file, an attacker may be able to take complete control ...

Microsoft Windows GDI WMF Handling Heap Overflow Vulnerability

Description The Microsoft Windows GDI Graphics Rendering Engine is prone to a heap-overflow vulnerability. This issue is exposed when the component loads a specially crafted WMF Windows Metafile image. If this issue is exploited, a malicious WMF or EMF file could potentially corrupt heap-based...

Microsoft Graphics Rendering Engine fails to properly handle WMF images

Overview Microsoft Windows Graphics Rendering Engine contains a vulnerability that may allow a remote attacker to execute arbitrary code on a vulnerable system. Description The Microsoft Windows Graphics Rendering Engine supports a number of image formats including Windows Metafile WMF. An...

Be careful alert! By the picture caused the overflow of the crisis-vulnerability warning-the black bar safety net

On the in just into the 2 0 0 6 year on the occasion, the Windows System has a serious vulnerability, which is the Microsoft Windows graphics rendering engine wmf format code vulnerability, ms0601 it. This vulnerability in the Windows graphics rendering engine, hackers can construct malicious wmf...

WMF and EMF Files (CVE-2005-2123; CVE-2005-2124; CVE-2005-4560; CVE-2006-0020)

...

Internet Explorer for Windows 2000 WMF files memory corruption

Memory corruption on Windows MetaFiles parsing...

Microsoft WMF memory corruption vulnerability

Overview Microsoft applications fail to properly handle Windows Metafile WMF images potentially allowing a remote attacker to execute arbitrary code on a vulnerable system. Description The Microsoft Windows Graphics Rendering Engine supports a number of image formats including WMF images. Windows...