Executive Summary

Informations
NameMDVSA-2009:106-1First vendor Publication2009-12-03
VendorMandrivaLast vendor Modification2009-12-03
Severity (Vendor) N/ARevisionN/A

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Cvss Base Score7.5Attack RangeNetwork
Cvss Impact Score6.4Attack ComplexityLow
Cvss Expoit Score10AuthenticationNone Required
Calculate full CVSS 2.0 Vectors scores

Detail

Use-after-free vulnerability in the embedded GD library in libwmf 0.2.8.4 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted WMF file (CVE-2009-1364).

The updated packages have been patched to prevent this.

Update:

Packages for 2008.0 are being provided due to extended support for Corporate products.

Original Source

Url : http://www.mandriva.com/security/advisories?name=MDVSA-2009:106-1

CWE : Common Weakness Enumeration

idName
CWE-399Resource Management Errors

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:10959
 
Oval ID: oval:org.mitre.oval:def:10959
Title: Use-after-free vulnerability in the embedded GD library in libwmf 0.2.8.4 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted WMF file.
Description: Use-after-free vulnerability in the embedded GD library in libwmf 0.2.8.4 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted WMF file.
Family: unix Class: vulnerability
Reference(s): CVE-2009-1364
Version: 5
Platform(s): Red Hat Enterprise Linux 4
CentOS Linux 4
Oracle Linux 4
Red Hat Enterprise Linux 5
CentOS Linux 5
Oracle Linux 5
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:21888
 
Oval ID: oval:org.mitre.oval:def:21888
Title: ELSA-2009:0457: libwmf security update (Moderate)
Description: Use-after-free vulnerability in the embedded GD library in libwmf 0.2.8.4 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted WMF file.
Family: unix Class: patch
Reference(s): ELSA-2009:0457-01
CVE-2009-1364
Version: 3
Platform(s): Oracle Linux 4
Oracle Linux 5
Product(s):
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application1

OpenVAS Exploits

DateDescription
2011-08-09Name : CentOS Update for libwmf CESA-2009:0457 centos4 i386
File : nvt/gb_CESA-2009_0457_libwmf_centos4_i386.nasl
2011-08-09Name : CentOS Update for libwmf CESA-2009:0457 centos5 i386
File : nvt/gb_CESA-2009_0457_libwmf_centos5_i386.nasl
2009-12-10Name : Mandriva Security Advisory MDVSA-2009:106-1 (libwmf)
File : nvt/mdksa_2009_106_1.nasl
2009-07-06Name : Gentoo Security Advisory GLSA 200907-01 (libwmf)
File : nvt/glsa_200907_01.nasl
2009-06-15Name : SuSE Security Summary SUSE-SR:2009:011
File : nvt/suse_sr_2009_011.nasl
2009-06-05Name : Mandrake Security Advisory MDVSA-2009:106 (libwmf)
File : nvt/mdksa_2009_106.nasl
2009-06-05Name : Ubuntu USN-769-1 (libwmf)
File : nvt/ubuntu_769_1.nasl
2009-06-05Name : Ubuntu USN-771-1 (libmodplug)
File : nvt/ubuntu_771_1.nasl
2009-06-05Name : Ubuntu USN-772-1 (mpfr)
File : nvt/ubuntu_772_1.nasl
2009-06-05Name : Ubuntu USN-773-1 (pango1.0)
File : nvt/ubuntu_773_1.nasl
2009-06-05Name : Fedora Core 9 FEDORA-2009-5517 (libwmf)
File : nvt/fcore_2009_5517.nasl
2009-06-05Name : Fedora Core 11 FEDORA-2009-5518 (libwmf)
File : nvt/fcore_2009_5518.nasl
2009-06-05Name : Fedora Core 10 FEDORA-2009-5524 (libwmf)
File : nvt/fcore_2009_5524.nasl
2009-05-20Name : CentOS Security Advisory CESA-2009:0457 (libwmf)
File : nvt/ovcesa2009_0457.nasl
2009-05-20Name : FreeBSD Ports: libwmf
File : nvt/freebsd_libwmf.nasl
2009-05-11Name : Debian Security Advisory DSA 1796-1 (libwmf)
File : nvt/deb_1796_1.nasl
2009-05-05Name : RedHat Security Advisory RHSA-2009:0457
File : nvt/RHSA_2009_0457.nasl

Open Source Vulnerability Database (OSVDB)

idDescription
56286libwmf Embedded GD Library WMF File Handling Use-After-Free Arbitrary Code Ex...

Nessus® Vulnerability Scanner

DateDescription
2013-07-12Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2009-0457.nasl - Type : ACT_GATHER_INFO
2012-08-01Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20090430_libwmf_on_SL4_x.nasl - Type : ACT_GATHER_INFO
2011-01-27Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_libwmf-6213.nasl - Type : ACT_GATHER_INFO
2009-09-24Name : The remote SuSE 11 host is missing a security update.
File : suse_11_libwmf-090428.nasl - Type : ACT_GATHER_INFO
2009-07-21Name : The remote SuSE system is missing a security patch for libwmf
File : suse_11_0_libwmf-090423.nasl - Type : ACT_GATHER_INFO
2009-07-21Name : The remote SuSE system is missing a security patch for libwmf
File : suse_11_1_libwmf-090512.nasl - Type : ACT_GATHER_INFO
2009-07-03Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-200907-01.nasl - Type : ACT_GATHER_INFO
2009-05-28Name : The remote Fedora host is missing a security update.
File : fedora_2009-5517.nasl - Type : ACT_GATHER_INFO
2009-05-28Name : The remote Fedora host is missing a security update.
File : fedora_2009-5518.nasl - Type : ACT_GATHER_INFO
2009-05-28Name : The remote Fedora host is missing a security update.
File : fedora_2009-5524.nasl - Type : ACT_GATHER_INFO
2009-05-26Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2009-0457.nasl - Type : ACT_GATHER_INFO
2009-05-18Name : The remote FreeBSD host is missing a security-related update.
File : freebsd_pkg_6a245f31425411deb67a0030843d3802.nasl - Type : ACT_GATHER_INFO
2009-05-15Name : The remote SuSE system is missing the security patch libwmf-6212
File : suse_libwmf-6212.nasl - Type : ACT_GATHER_INFO
2009-05-08Name : The remote Debian host is missing a security-related update.
File : debian_DSA-1796.nasl - Type : ACT_GATHER_INFO
2009-05-06Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2009-106.nasl - Type : ACT_GATHER_INFO
2009-05-05Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-769-1.nasl - Type : ACT_GATHER_INFO
2009-05-01Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2009-0457.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
DateInformations
2014-02-17 11:40:15
  • Multiple Updates