Mandrake Linux Security Advisory : libwmf (MDKSA-2006:114-1)

This script is Copyright (C) 2006-2013 Tenable Network Security, Inc.


Synopsis :

The remote Mandrake Linux host is missing one or more security
updates.

Description :

Multiple buffer overflows in the gd graphics library (libgd) 2.0.21
and earlier may allow remote attackers to execute arbitrary code via
malformed image files that trigger the overflows due to improper calls
to the gdMalloc function. (CVE-2004-0941)

Integer overflows were reported in the GD Graphics Library (libgd)
2.0.28, and possibly other versions. These overflows allow remote
attackers to cause a denial of service and possibly execute arbitrary
code via PNG image files with large image rows values that lead to a
heap-based buffer overflow in the gdImageCreateFromPngCtx() function.
Libwmf contains an embedded copy of the GD library code.
(CVE-2004-0990)

Update :

The previous update incorrectly attributed the advisory text to
CVE-2004-0941, while it should have been CVE-2004-0990. Additional
review of the code found fixes for CVE-2004-0941 were missing and have
also been included in this update.

Solution :

Update the affected packages.

Risk factor :

Critical / CVSS Base Score : 10.0
(CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)

Family: Mandriva Local Security Checks

Nessus Plugin ID: 21776 (mandrake_MDKSA-2006-114.nasl)

Bugtraq ID:

CVE ID: CVE-2004-0941
CVE-2004-0990

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now