Vulnerabilities > CVE-2009-1364 - Remote Code Execution vulnerability in libwmf WMF Image File
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
PARTIAL Integrity impact
PARTIAL Availability impact
PARTIAL Summary
Use-after-free vulnerability in the embedded GD library in libwmf 0.2.8.4 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted WMF file. <a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a>
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 1 | |
| OS | 2 |
Nessus
NASL family Scientific Linux Local Security Checks NASL id SL_20090430_LIBWMF_ON_SL4_X.NASL description A pointer use-after-free flaw was found in the GD graphics library embedded in libwmf. An attacker could create a specially crafted WMF file that would cause an application using libwmf to crash or, potentially, execute arbitrary code as the user running the application when opened by a victim. (CVE-2009-1364) After installing the update, all applications using libwmf must be restarted for the update to take effect. last seen 2020-06-01 modified 2020-06-02 plugin id 60578 published 2012-08-01 reporter This script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/60578 title Scientific Linux Security Update : libwmf on SL4.x, SL5.x i386/x86_64 NASL family Debian Local Security Checks NASL id DEBIAN_DSA-1796.NASL description Tavis Ormandy discovered that the embedded GD library copy in libwmf, a library to parse windows metafiles (WMF), makes use of a pointer after it was already freed. An attacker using a crafted WMF file can cause a denial of service or possibly the execute arbitrary code via applications using this library. last seen 2020-06-01 modified 2020-06-02 plugin id 38704 published 2009-05-08 reporter This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/38704 title Debian DSA-1796-1 : libwmf - pointer use-after-free NASL family SuSE Local Security Checks NASL id SUSE_11_0_LIBWMF-090423.NASL description A specially crafted WMF files could crash libwmf. (CVE-2009-1364) last seen 2020-06-01 modified 2020-06-02 plugin id 40052 published 2009-07-21 reporter This script is Copyright (C) 2009-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/40052 title openSUSE Security Update : libwmf (libwmf-821) NASL family Mandriva Local Security Checks NASL id MANDRIVA_MDVSA-2009-106.NASL description Use-after-free vulnerability in the embedded GD library in libwmf 0.2.8.4 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted WMF file (CVE-2009-1364). The updated packages have been patched to prevent this. Update : Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers last seen 2020-06-01 modified 2020-06-02 plugin id 38693 published 2009-05-06 reporter This script is Copyright (C) 2009-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/38693 title Mandriva Linux Security Advisory : libwmf (MDVSA-2009:106-1) NASL family Fedora Local Security Checks NASL id FEDORA_2009-5524.NASL description CVE-2009-1364 libwmf: embedded gd use-after-free error Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 38936 published 2009-05-28 reporter This script is Copyright (C) 2009-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/38936 title Fedora 10 : libwmf-0.2.8.4-18.1.fc10 (2009-5524) NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-769-1.NASL description Tavis Ormandy discovered that libwmf incorrectly used memory after it had been freed when using its embedded GD library. If a user or automated system were tricked into opening a crafted WMF file, an attacker could cause a denial of service or execute arbitrary code with privileges of the user invoking the program. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 38685 published 2009-05-05 reporter Ubuntu Security Notice (C) 2009-2019 Canonical, Inc. / NASL script (C) 2009-2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/38685 title Ubuntu 6.06 LTS / 8.04 LTS / 8.10 / 9.04 : libwmf vulnerability (USN-769-1) NASL family FreeBSD Local Security Checks NASL id FREEBSD_PKG_6A245F31425411DEB67A0030843D3802.NASL description Secunia reports : A vulnerability has been reported in libwmf, which can be exploited by malicious people to cause a DoS (Denial of Service) or compromise an application using the library. The vulnerability is caused due to a use-after-free error within the embedded GD library, which can be exploited to cause a crash or potentially to execute arbitrary code via a specially crafted WMF file. last seen 2020-06-01 modified 2020-06-02 plugin id 38804 published 2009-05-18 reporter This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/38804 title FreeBSD : libwmf -- embedded GD library Use-After-Free vulnerability (6a245f31-4254-11de-b67a-0030843d3802) NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2009-0457.NASL description Updated libwmf packages that fix one security issue are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. libwmf is a library for reading and converting Windows Metafile Format (WMF) vector graphics. libwmf is used by applications such as GIMP and ImageMagick. A pointer use-after-free flaw was found in the GD graphics library embedded in libwmf. An attacker could create a specially crafted WMF file that would cause an application using libwmf to crash or, potentially, execute arbitrary code as the user running the application when opened by a victim. (CVE-2009-1364) Note: This flaw is specific to the GD graphics library embedded in libwmf. It does not affect the GD graphics library from the last seen 2020-06-01 modified 2020-06-02 plugin id 38659 published 2009-05-01 reporter This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/38659 title RHEL 4 / 5 : libwmf (RHSA-2009:0457) NASL family CentOS Local Security Checks NASL id CENTOS_RHSA-2009-0457.NASL description Updated libwmf packages that fix one security issue are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. libwmf is a library for reading and converting Windows Metafile Format (WMF) vector graphics. libwmf is used by applications such as GIMP and ImageMagick. A pointer use-after-free flaw was found in the GD graphics library embedded in libwmf. An attacker could create a specially crafted WMF file that would cause an application using libwmf to crash or, potentially, execute arbitrary code as the user running the application when opened by a victim. (CVE-2009-1364) Note: This flaw is specific to the GD graphics library embedded in libwmf. It does not affect the GD graphics library from the last seen 2020-06-01 modified 2020-06-02 plugin id 38900 published 2009-05-26 reporter This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/38900 title CentOS 4 / 5 : libwmf (CESA-2009:0457) NASL family Gentoo Local Security Checks NASL id GENTOO_GLSA-200907-01.NASL description The remote host is affected by the vulnerability described in GLSA-200907-01 (libwmf: User-assisted execution of arbitrary code) The embedded fork of the GD library introduced a last seen 2020-06-01 modified 2020-06-02 plugin id 39595 published 2009-07-03 reporter This script is Copyright (C) 2009-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/39595 title GLSA-200907-01 : libwmf: User-assisted execution of arbitrary code NASL family SuSE Local Security Checks NASL id SUSE_11_1_LIBWMF-090512.NASL description A specially crafted WMF files could crash libwmf. (CVE-2009-1364) last seen 2020-06-01 modified 2020-06-02 plugin id 40273 published 2009-07-21 reporter This script is Copyright (C) 2009-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/40273 title openSUSE Security Update : libwmf (libwmf-821) NASL family SuSE Local Security Checks NASL id SUSE_LIBWMF-6213.NASL description A specially crafted WMF files could crash libwmf. (CVE-2009-1364) last seen 2020-06-01 modified 2020-06-02 plugin id 51755 published 2011-01-27 reporter This script is Copyright (C) 2011-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/51755 title SuSE 10 Security Update : libwmf (ZYPP Patch Number 6213) NASL family Fedora Local Security Checks NASL id FEDORA_2009-5518.NASL description CVE-2009-1364 libwmf: embedded gd use-after-free error Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 38934 published 2009-05-28 reporter This script is Copyright (C) 2009-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/38934 title Fedora 11 : libwmf-0.2.8.4-20.fc11 (2009-5518) NASL family SuSE Local Security Checks NASL id SUSE_11_LIBWMF-090428.NASL description A specially crafted WMF files could crash libwmf. (CVE-2009-1364) last seen 2020-06-01 modified 2020-06-02 plugin id 41433 published 2009-09-24 reporter This script is Copyright (C) 2009-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/41433 title SuSE 11 Security Update : libwmf (SAT Patch Number 822) NASL family Fedora Local Security Checks NASL id FEDORA_2009-5517.NASL description CVE-2009-1364 libwmf: embedded gd use-after-free error Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 38933 published 2009-05-28 reporter This script is Copyright (C) 2009-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/38933 title Fedora 9 : libwmf-0.2.8.4-18.1.fc9 (2009-5517) NASL family Oracle Linux Local Security Checks NASL id ORACLELINUX_ELSA-2009-0457.NASL description From Red Hat Security Advisory 2009:0457 : Updated libwmf packages that fix one security issue are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. libwmf is a library for reading and converting Windows Metafile Format (WMF) vector graphics. libwmf is used by applications such as GIMP and ImageMagick. A pointer use-after-free flaw was found in the GD graphics library embedded in libwmf. An attacker could create a specially crafted WMF file that would cause an application using libwmf to crash or, potentially, execute arbitrary code as the user running the application when opened by a victim. (CVE-2009-1364) Note: This flaw is specific to the GD graphics library embedded in libwmf. It does not affect the GD graphics library from the last seen 2020-06-01 modified 2020-06-02 plugin id 67851 published 2013-07-12 reporter This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/67851 title Oracle Linux 4 / 5 : libwmf (ELSA-2009-0457) NASL family SuSE Local Security Checks NASL id SUSE_LIBWMF-6212.NASL description A specially crafted WMF files could crash libwmf. (CVE-2009-1364) last seen 2020-06-01 modified 2020-06-02 plugin id 38788 published 2009-05-15 reporter This script is Copyright (C) 2009-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/38788 title openSUSE 10 Security Update : libwmf (libwmf-6212) NASL family SuSE Local Security Checks NASL id SUSE_SU-2015-1484-1.NASL description libwmf was updated to fix five security issues. These security issues were fixed : - CVE-2009-1364: Fixed realloc return value usage (bsc#495842, bnc#831299) - CVE-2015-0848: Heap overflow on libwmf0.2-7 (bsc#933109) - CVE-2015-4588: DecodeImage() did not check that the run-length last seen 2020-06-01 modified 2020-06-02 plugin id 85796 published 2015-09-04 reporter This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/85796 title SUSE SLED12 Security Update : libwmf (SUSE-SU-2015:1484-1) NASL family SuSE Local Security Checks NASL id OPENSUSE-2015-443.NASL description libwmf was updated to fix three security issues and one non-security bug. The following vulnerabilities were fixed : - CVE-2015-0848: An attacker that could trick a victim into opening a specially crafted WMF file with BMP portions in a libwmf based application could have executed arbitrary code with the user last seen 2020-06-05 modified 2015-06-25 plugin id 84384 published 2015-06-25 reporter This script is Copyright (C) 2015-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/84384 title openSUSE Security Update : libwmf (openSUSE-2015-443)
Oval
| accepted | 2013-04-29T04:10:16.812-04:00 | ||||||||||||||||||||||||
| class | vulnerability | ||||||||||||||||||||||||
| contributors |
| ||||||||||||||||||||||||
| definition_extensions |
| ||||||||||||||||||||||||
| description | Use-after-free vulnerability in the embedded GD library in libwmf 0.2.8.4 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted WMF file. | ||||||||||||||||||||||||
| family | unix | ||||||||||||||||||||||||
| id | oval:org.mitre.oval:def:10959 | ||||||||||||||||||||||||
| status | accepted | ||||||||||||||||||||||||
| submitted | 2010-07-09T03:56:16-04:00 | ||||||||||||||||||||||||
| title | Use-after-free vulnerability in the embedded GD library in libwmf 0.2.8.4 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted WMF file. | ||||||||||||||||||||||||
| version | 27 |
Redhat
| advisories |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| rpms |
|
References
- http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html
- http://lists.opensuse.org/opensuse-updates/2015-06/msg00051.html
- http://lists.opensuse.org/opensuse-updates/2015-06/msg00053.html
- http://rhn.redhat.com/errata/RHSA-2009-0457.html
- http://secunia.com/advisories/34901
- http://secunia.com/advisories/34964
- http://secunia.com/advisories/35001
- http://secunia.com/advisories/35025
- http://secunia.com/advisories/35190
- http://secunia.com/advisories/35416
- http://secunia.com/advisories/35686
- http://security.gentoo.org/glsa/glsa-200907-01.xml
- http://wvware.cvs.sourceforge.net/viewvc/wvware/libwmf2/src/extra/Makefile.am?hideattic=0&view=log
- http://www.debian.org/security/2009/dsa-1796
- http://www.mandriva.com/security/advisories?name=MDVSA-2009:106
- http://www.securityfocus.com/bid/34792
- http://www.securitytracker.com/id?1022154
- http://www.ubuntu.com/usn/USN-769-1
- http://www.vupen.com/english/advisories/2009/1228
- https://bugzilla.redhat.com/show_bug.cgi?id=496864
- https://exchange.xforce.ibmcloud.com/vulnerabilities/50290
- https://launchpad.net/bugs/cve/2009-1364
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10959
- https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01263.html
- https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01266.html
- https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01269.html