The wv library is vulnerable to multiple integer overflows which could lead to the execution of arbitrary code.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200612-01 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: wv library: Multiple integer overflows Date: December 07, 2006 Bugs: #153800 ID: 200612-01 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= The wv library is vulnerable to multiple integer overflows which could lead to the execution of arbitrary code. Background ========= wv is a library for conversion of MS Word DOC and RTF files. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 app-text/wv < 1.2.3-r1 > = 1.2.3-r1 Description ========== The wv library fails to do proper arithmetic checks in multiple places, possibly leading to integer overflows. Impact ===== An attacker could craft a malicious file that, when handled with the wv library, could lead to the execution of arbitrary code with the permissions of the user running the application. Workaround ========= There is no known workaround at this time. Resolution ========= All wv library users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =app-text/wv-1.2.3-r1" References ========= [ 1 ] CVE-2006-4513 https://www.cve.org/CVERecord?id=CVE-2006-4513 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/200612-01 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to
An integer overflow was discovered in the DOC file parser of the wv library. By tricking a user into opening a specially crafted MSWord (.DOC) file, remote attackers could execute arbitrary code with the user's privileges. . =========================================================== Ubuntu Security Notice USN-374-1 November 01, 2006 wv vulnerability CVE-2006-4513 ========================================================== A security issue affects the following Ubuntu releases: Ubuntu 6.10 This advisory also applies to the corresponding versions of Kubuntu, Edubuntu, and Xubuntu. The problem can be corrected by upgrading your system to the following package versions: Ubuntu 6.10: libwv-1.2-1 1.2.1-2ubuntu0.1 In general, a standard system upgrade is sufficient to effect the necessary changes. Details follow: An integer overflow was discovered in the DOC file parser of the wv library. By tricking a user into opening a specially crafted MSWord (.DOC) file, remote attackers could execute arbitrary code with the user's privileges. Updated packages for Ubuntu 6.10: Source archives: Size/MD5: 11929 1162b872e4e77345295a34e0c7fb731b Size/MD5: 716 4ec3816084073a77df966ff2fec1a40e Size/MD5: 628027 d757080af4595839d5d82a1a573c692c amd64 architecture (Athlon64, Opteron, EM64T Xeon) Size/MD5: 146278 3eb3817dfa782c6e3bcc22c6fb35b8ad Size/MD5: 202772 30ebeb74c64333e33d5604df48a0f8f0 Size/MD5: 90506 a1835a5db7c038487567686e77a95f9a i386 architecture (x86 compatible Intel/AMD) Size/MD5: 138724 918761ea08c2eb366821648adc571bc3 Size/MD5: 180656 f041845463774af932bdd8a848422481 Size/MD5: 88162 3940c61f26c24d2ac1f66d33a7f00166 powerpc architecture (Apple Macintosh G3/G4/G5) Size/MD5: 140532 6f76eefa75620e73bfe7738e67618bab Size/MD5: 207102 d241cdb9f374c6f6b61c7ce9667f79b6 Size/MD5: 94366 682568966d755eb3e55ef210ff08dd05 sparc architecture (Sun SPARC/UltraSPARC) Size/MD5: 136236 a8a17256755dfb88d996972dd76736d7 Size/MD5: 189474 7e263e180bcf218dd6714ab813c9bf97 Size/MD5: 88130 413b2fb70a223db99545e4e3ccbe2145 . Fedora Security Advisory FSA-2023-045 warns of a potential exploit in the libxml2 library that could permit unauthorized access through malformed XML documents.. wvLibrary Security, Remote Code Execution, Integer Overflow, Security Update. . Severity: Critical. LinuxSecurity.com Team
iDEFENSE discovered a buffer overflow in the wv library, used toconvert and preview Microsoft Word documents.. -------------------------------------------------------------------------- Debian Security Advisory DSA 550-1
Get the latest Linux and open source security news straight to your inbox.