Memory Allocation Flaw in libwmf Affects Application Stability
CVE-2016-9011

5.5MEDIUM

Key Information:

Vendor

Wvware

Status
Libwmf
Vendor
CVE Published:
23 March 2017

What is CVE-2016-9011?

The function wmf_malloc in libwmf 0.2.8.4 is vulnerable to a crafted WMF file that can lead to a denial of service by triggering a memory allocation failure, causing the application to crash. This vulnerability enables remote attackers to destabilize applications that utilize the affected library. Proper input validation and memory management practices are essential to mitigate this risk.

References

https://bugzilla.redhat.com/show_bug.cgi?id=1388450
x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2016/10/25/1
mailing-listx_refsource_MLIST
https://blogs.gentoo.org/ago/2016/10/18/libwmf-memory-all...
x_refsource_MISC

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.