Bug 1835793 (CVE-2020-11866)

Summary: CVE-2020-11866 libEMF: allows a use-after-free
Product: [Other] Security Response Reporter: Guilherme de Almeida Suckevicz <gsuckevi>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED WONTFIX QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: databases-maint, dominik, itamar, mmuzila, mplch, mschorm, rob.myers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Fixed In Version: libEMF 1.0.12 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-05-27 11:20:31 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1835794    
Bug Blocks: 1835809    

Description Guilherme de Almeida Suckevicz 2020-05-14 13:54:15 UTC
libEMF (aka ECMA-234 Metafile Library) through 1.0.11 allows a use-after-free.


Comment 1 Guilherme de Almeida Suckevicz 2020-05-14 13:54:32 UTC
Created libEMF tracking bugs for this issue:

Affects: fedora-all [bug 1835794]

Comment 2 Huzaifa S. Sidhpurwala 2020-05-27 05:36:16 UTC
External References:


Comment 3 Huzaifa S. Sidhpurwala 2020-05-27 05:41:34 UTC

libEMF is a C/C++ library which provides a drawing toolkit based on ECMA-234. The general purpose of this library is to create vector graphics files on POSIX systems which can be imported into OpenOffice.org or LibreOffice. Programs compiled with libEMF, output ECMA-234 graphics files locally which can be then imported into desktop applications. Therefore this use-after-free flaw can only be triggered via maliciously written applications compiled with libEMF.

Comment 4 Huzaifa S. Sidhpurwala 2020-05-27 05:43:54 UTC
Upstream commit: https://sourceforge.net/p/libemf/code/92/

Comment 5 Product Security DevOps Team 2020-05-27 11:20:31 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):