Bug 1835802 (CVE-2020-11864)

Summary: CVE-2020-11864 libEMF: allows denial of service (issue 2 of 2)
Product: [Other] Security Response Reporter: Guilherme de Almeida Suckevicz <gsuckevi>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED WONTFIX QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: databases-maint, dominik, itamar, mmuzila, mplch, mschorm, rob.myers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Fixed In Version: libEMF 1.0.12 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-06-01 05:38:44 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1835803    
Bug Blocks: 1835809    

Description Guilherme de Almeida Suckevicz 2020-05-14 14:03:30 UTC
libEMF (aka ECMA-234 Metafile Library) through 1.0.11 allows denial of service (issue 2 of 2).


Comment 1 Guilherme de Almeida Suckevicz 2020-05-14 14:03:45 UTC
Created libEMF tracking bugs for this issue:

Affects: fedora-all [bug 1835803]

Comment 2 Huzaifa S. Sidhpurwala 2020-06-01 05:25:42 UTC
External References:


Comment 3 Huzaifa S. Sidhpurwala 2020-06-01 05:33:56 UTC

libEMF is a C/C++ library which provides a drawing toolkit based on ECMA-234. The general purpose of this library is to create vector graphics files on POSIX systems which can be imported into OpenOffice.org or LibreOffice. Programs compiled with libEMF, output ECMA-234 graphics files locally which can be then imported into desktop applications. Therefore this denial-of-service flaw can only be triggered via maliciously written applications compiled with libEMF.