Bug 1835806 (CVE-2020-11865)

Summary: CVE-2020-11865 libEMF: allows out-of-bounds memory access
Product: [Other] Security Response Reporter: Guilherme de Almeida Suckevicz <gsuckevi>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED WONTFIX QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: databases-maint, dominik, itamar, mmuzila, mplch, mschorm, rob.myers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: libEMF 1.0.12 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-06-01 05:38:53 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1835807    
Bug Blocks: 1835809    

Description Guilherme de Almeida Suckevicz 2020-05-14 14:09:45 UTC
libEMF (aka ECMA-234 Metafile Library) through 1.0.11 allows out-of-bounds memory access.

Reference:
https://sourceforge.net/p/libemf/news/2020/05/re-release-of-libemf-1012/

Comment 1 Guilherme de Almeida Suckevicz 2020-05-14 14:10:01 UTC
Created libEMF tracking bugs for this issue:

Affects: fedora-all [bug 1835807]

Comment 2 Dominik 'Rathann' Mierzejewski 2020-05-15 07:45:35 UTC
Only F31 and older are affected. F32 has 1.0.12.

Comment 3 Huzaifa S. Sidhpurwala 2020-06-01 05:27:24 UTC
External References:

https://sourceforge.net/p/libemf/news/2020/05/re-release-of-libemf-1012/

Comment 4 Huzaifa S. Sidhpurwala 2020-06-01 05:36:58 UTC
Statement:

libEMF is a C/C++ library which provides a drawing toolkit based on ECMA-234. The general purpose of this library is to create vector graphics files on POSIX systems which can be imported into OpenOffice.org or LibreOffice. Programs compiled with libEMF, output ECMA-234 graphics files locally which can be then imported into desktop applications. Therefore this out of bounds memory access flaw can only be triggered via maliciously written applications compiled with libEMF.