Stay Secure with the Latest Linux Advisories

security advisorycriticalFedora

Fedora 22: FEDORA-2015-10627 Critical: Libwmf Heap Overflow

CVE-2015-0848 heap overflow when decoding BMP images CVE-2015-4588 RLE decoding doesn't check that the "count" fits into the image CVE-2015-4695 meta_pen_create heap buffer overflow CVE-2015-4696 wmf2gd/wmf2eps use after free. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2015-10627 2015-06-24 11:12:35 -------------------------------------------------------------------------------- Name : libwmf Product : Fedora 22 Version : 0.2.8.4 Release : 45.fc22 URL : Summary : Windows MetaFile Library Description : A library for reading and converting Windows MetaFile vector graphics (WMF). -------------------------------------------------------------------------------- Update Information: CVE-2015-0848 heap overflow when decoding BMP images CVE-2015-4588 RLE decoding doesn't check that the "count" fits into the image CVE-2015-4695 meta_pen_create heap buffer overflow CVE-2015-4696 wmf2gd/wmf2eps use after free -------------------------------------------------------------------------------- ChangeLog: * Tue Jun 23 2015 Caolán McNamara - 0.2.8.4-45 - Related: rhbz#1227244 CVE-2015-4695 meta_pen_create heap buffer overflow - Related: rhbz#1227244 CVE-2015-4696 wmf2gd/wmf2eps use after free * Wed Jun 17 2015 Fedora Release Engineering - 0.2.8.4-44 - Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild * Tue Jun 9 2015 Caolán McNamara - 0.2.8.4-43 - Resolves: rhbz#1227244 CVE-2015-0848 heap overflow when decoding BMP images * Tue Jun 2 2015 Caolán McNamara - 0.2.8.4-42 - Resolves: rhbz#1227244 CVE-2015-0848 heap overflow when decoding BMP images * Sat Feb 21 2015 Till Maas - 0.2.8.4-41 - Rebuilt for Fedora 23 Change https://fedoraproject.org/wiki/Changes/Harden_all_packages_with_position-independent_code -------------------------------------------------------------------------------- References: [ 1 ] Bug #1227244 - CVE-2015-0848 libwmf: heap overflow when decoding BMP images[fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1227244 [ 2 ] Bug #1235671 - CVE-2015-4696 CVE-2015-4695 libwmf: various flaws [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1235671 -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update libwmf' at the command line. For more information, refer to "Managing Software with yum", available at . All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list This email address is being protected from spambots. You need JavaScript enabled to view it. https://lists.fedoraproject.org/admin/lists/package-announce.lists.fedoraproject.org/ . An important security patch for Fedora 22 has been released to fix several heap overflow and use-after-free vulnerabilities in libwmf.. Libwmf Security Update,Fedora 22 Update,Heap Overflow Fix. . Severity: Critical. LinuxSecurity.com Team

Jul 10, 2015 •Critical Fedora