OpenPKG alert OpenPKG-SA-2006.031 (libwmf)

From:
    	     
 
OpenPKG <openpkg@openpkg.org>
To:
    	     
 
openpkg-announce@openpkg.org
Subject:
    	     
 
[OpenPKG-SA-2006.031] OpenPKG Security Advisory (libwmf)
Date:
    	     
 
Sat, 4 Nov 2006 20:18:20 +0100
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

________________________________________________________________________

OpenPKG Security Advisory                                   OpenPKG GmbH
http://openpkg.org/security/                          http://openpkg.com
OpenPKG-SA-2006.031                                           2006-11-04
________________________________________________________________________

Package:          libwmf
Vulnerability:    arbitrary code execution
OpenPKG Specific: no

Affected Series:  Affected Packages:           Corrected Packages:
E1.0-SOLID        <= libwmf-0.2.8.4-E1.0.0     >= libwmf-0.2.8.4-E1.0.1
2-STABLE-20061018 <= libwmf-0.2.8.4-2.20061018 >= libwmf-0.2.8.4-2.20061104
2-STABLE          <= libwmf-0.2.8.4-2.20061018 >= libwmf-0.2.8.4-2.20061104
CURRENT           <= libwmf-0.2.8.4-20061016   >= libwmf-0.2.8.4-20061104

Description:
  According to a BUGTRAQ posting [0], a vulnerability exists in the WMF
  format management library libwmf [1]. The vulnerability consists of an
  integer overflow which allows remote attackers to execute arbitrary
  code via the "MaxRecordSize" header field in a WMF format file. The
  Common Vulnerabilities and Exposures (CVE) project assigned the id
  CVE-2006-3376 [2] to the problem.
________________________________________________________________________

References:
  [0] http://www.securityfocus.com/archive/1/archive/1/438803/1...
  [1] http://wvware.sourceforge.net/libwmf.html
  [2] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3376
________________________________________________________________________

For security reasons, this advisory was digitally signed with the
OpenPGP public key "OpenPKG <openpkg@openpkg.org>" (ID 63C4CB9F) which
you can retrieve from http://openpkg.org/openpkg.org.pgp. Follow the
instructions on http://openpkg.org/security/signatures/ for details on
how to verify the integrity of this advisory.
________________________________________________________________________

-----BEGIN PGP SIGNATURE-----
Comment: OpenPKG <openpkg@openpkg.org>

iD8DBQFFTOc1gHWT4GPEy58RAo3PAKDBzV3+Z8WHTN2cVWslZ5OWzghJ/gCgg9tv
FCLjoDh5bB5PVrzTTb/GNVc=
=Yw2V
-----END PGP SIGNATURE-----
______________________________________________________________________
The OpenPKG Project                                    www.openpkg.org
Project Announcement List                 openpkg-announce@openpkg.org