Bug 1835806 (CVE-2020-11865)

Summary:	CVE-2020-11865 libEMF: allows out-of-bounds memory access
Product:	[Other] Security Response	Reporter:	Guilherme de Almeida Suckevicz <gsuckevi>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	databases-maint, dominik, itamar, mmuzila, mplch, mschorm, rob.myers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	libEMF 1.0.12	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-06-01 05:38:53 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1835807
Bug Blocks:	1835809

Description Guilherme de Almeida Suckevicz 2020-05-14 14:09:45 UTC

libEMF (aka ECMA-234 Metafile Library) through 1.0.11 allows out-of-bounds memory access.

Reference:
https://sourceforge.net/p/libemf/news/2020/05/re-release-of-libemf-1012/

Comment 1 Guilherme de Almeida Suckevicz 2020-05-14 14:10:01 UTC

Created libEMF tracking bugs for this issue:

Affects: fedora-all [bug 1835807]

Comment 2 Dominik 'Rathann' Mierzejewski 2020-05-15 07:45:35 UTC

Only F31 and older are affected. F32 has 1.0.12.

Comment 3 Huzaifa S. Sidhpurwala 2020-06-01 05:27:24 UTC

External References:

https://sourceforge.net/p/libemf/news/2020/05/re-release-of-libemf-1012/

Comment 4 Huzaifa S. Sidhpurwala 2020-06-01 05:36:58 UTC

Statement:

libEMF is a C/C++ library which provides a drawing toolkit based on ECMA-234. The general purpose of this library is to create vector graphics files on POSIX systems which can be imported into OpenOffice.org or LibreOffice. Programs compiled with libEMF, output ECMA-234 graphics files locally which can be then imported into desktop applications. Therefore this out of bounds memory access flaw can only be triggered via maliciously written applications compiled with libEMF.