Bug 1850254 (CVE-2020-13999) - CVE-2020-13999 libemf: Integer overflow which could result in denial of service
Summary: CVE-2020-13999 libemf: Integer overflow which could result in denial of service
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2020-13999
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1850255
Blocks: 1850256
TreeView+ depends on / blocked
 
Reported: 2020-06-23 19:54 UTC by Michael Kaplan
Modified: 2021-02-16 19:47 UTC (History)
7 users (show)

Fixed In Version: libEMF-1.0.13
Clone Of:
Environment:
Last Closed: 2020-07-14 19:27:37 UTC
Embargoed:

Attachments (Terms of Use)

Description Michael Kaplan 2020-06-23 19:54:26 UTC 
ScaleViewPortExtEx in libemf.cpp in libEMF (aka ECMA-234 Metafile Library) through 1.0.12 allows an integer overflow and denial of service via a crafted EMF file.

References:

http://libemf.sourceforge.net/index.html
https://sourceforge.net/p/libemf/code/HEAD/tree/
https://sourceforge.net/p/libemf/news/2020/06/release-of-libemf-1013/
https://sourceforge.net/projects/libemf/
Comment 1 Michael Kaplan 2020-06-23 19:54:41 UTC 
Created libEMF tracking bugs for this issue:

Affects: fedora-all [bug 1850255]
Comment 2 Doran Moppert 2020-07-08 02:31:01 UTC 
Statement:

libEMF is a C/C++ library which provides a drawing toolkit based on ECMA-234. The general purpose of this library is to create vector graphics files on POSIX systems which can be imported into OpenOffice.org or LibreOffice. Programs compiled with libEMF, output ECMA-234 graphics files locally which can be then imported into desktop applications. Therefore this vulnerability can only be triggered via maliciously written applications compiled with libEMF.
Comment 3 Product Security DevOps Team 2020-07-14 19:27:37 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-13999
Note You need to log in before you can comment on or make changes to this bug.