Vulmon
Amazon Linux AMI Security Advisory: ALAS-2015-604
Advisory Release Date: 2015-10-27 13:51 Pacific
Advisory Updated Date: 2015-10-27 14:16 Pacific
It was discovered that libwmf did not correctly process certain WMF (Windows Metafiles) with embedded BMP images. By tricking a victim into opening a specially crafted WMF file in an application using libwmf, a remote attacker could possibly use this flaw to execute arbitrary code with the privileges of the user running the application. (CVE-2015-0848, CVE-2015-4588)
It was discovered that libwmf did not properly process certain WMF files. By tricking a victim into opening a specially crafted WMF file in an application using libwmf, a remote attacker could possibly exploit this flaw to cause a crash or execute arbitrary code with the privileges of the user running the application. (CVE-2015-4696)
It was discovered that libwmf did not properly process certain WMF files. By tricking a victim into opening a specially crafted WMF file in an application using libwmf, a remote attacker could possibly exploit this flaw to cause a crash. (CVE-2015-4695)
The gdPngReadData function in libgd 2.0.34 allows user-assisted attackers to cause a denial of service (CPU consumption) via a crafted PNG image with truncated data, which causes an infinite loop in the png_read_info function in libpng. (CVE-2007-2756)
Buffer overflow in the gdImageStringFTEx function in gdft.c in GD Graphics Library 2.0.33 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted string with a JIS encoded font. (CVE-2007-0455)
The _gdGetColors function in gd_gd.c in PHP 5.2.11 and 5.3.x before 5.3.1, and the GD Graphics Library 2.x, does not properly verify a certain colorsTotal structure member, which might allow remote attackers to conduct buffer overflow or buffer over-read attacks via a crafted GD file, a different vulnerability than CVE-2009-3293. NOTE: some of these details are obtained from third party information. (CVE-2009-3546)
Integer overflow in gdImageCreateTrueColor function in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to have unspecified attack vectors and impact. (CVE-2007-3472)
The gdImageCreateXbm function in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash) via unspecified vectors involving a gdImageCreate failure. (CVE-2007-3473)
Affected Packages:
libwmf
Issue Correction:
Run yum update libwmf to update your system.
i686:
libwmf-debuginfo-0.2.8.4-41.11.amzn1.i686
libwmf-devel-0.2.8.4-41.11.amzn1.i686
libwmf-0.2.8.4-41.11.amzn1.i686
libwmf-lite-0.2.8.4-41.11.amzn1.i686
src:
libwmf-0.2.8.4-41.11.amzn1.src
x86_64:
libwmf-lite-0.2.8.4-41.11.amzn1.x86_64
libwmf-devel-0.2.8.4-41.11.amzn1.x86_64
libwmf-debuginfo-0.2.8.4-41.11.amzn1.x86_64
libwmf-0.2.8.4-41.11.amzn1.x86_64