Bug 198290
| Summary: | CVE-2006-3376 libwmf integer overflow | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 4 | Reporter: | Josh Bressers <bressers> | ||||||||
| Component: | libwmf | Assignee: | Caolan McNamara <caolanm> | ||||||||
| Status: | CLOSED ERRATA | QA Contact: | |||||||||
| Severity: | medium | Docs Contact: | |||||||||
| Priority: | medium | ||||||||||
| Version: | 4.0 | Keywords: | Security | ||||||||
| Target Milestone: | --- | ||||||||||
| Target Release: | --- | ||||||||||
| Hardware: | All | ||||||||||
| OS: | Linux | ||||||||||
| Whiteboard: | source=cve,reported=20060706,impact=moderate,public=20060630 | ||||||||||
| Fixed In Version: | RHSA-2006-0597 | Doc Type: | Bug Fix | ||||||||
| Doc Text: | Story Points: | --- | |||||||||
| Clone Of: | Environment: | ||||||||||
| Last Closed: | 2006-07-18 10:31:12 UTC | Type: | --- | ||||||||
| Regression: | --- | Mount Type: | --- | ||||||||
| Documentation: | --- | CRM: | |||||||||
| Verified Versions: | Category: | --- | |||||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||||
| Embargoed: | |||||||||||
| Attachments: |
|
||||||||||
|
Description
Josh Bressers
2006-07-10 20:50:23 UTC
Created attachment 132225 [details]
maybe this will suffice
Created attachment 132312 [details]
testcase
I don't have a proper test case, but here's a wmf which has a size field which
will overflow as reported above on a box where size_t is 32. With the fix in
place it shouldn't open on such a system.
built and mkerrata-wrapper dist-4E-errata-candidate libwmf-0.2.8.3-5.2 has been run. The attached .wmf shouldn't open on 32bit platforms after this change, but normal .wmf's should RHSA-2006:0597 in progress. Created attachment 132425 [details]
maybe a better testcase
Maybe this testcase will trigger better on RHEL-4 ?
Seems to work better, but shows I need another fix for casting on 64bit. built and mkerrata-wrapper dist-4E-errata-candidate libwmf-0.2.8.3-5.3 has been run. An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on the solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHSA-2006-0597.html |