Low: libwmf security update
Summary
ALSA-2019:2722: Low: libwmf security update. Affects libwmf versions < 0.2.9-8.el8_0. Fixed in 0.2.9-8.el8_0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The libwmf packages provide a library for reading and converting Windows Metafile Format (WMF) vector graphics. The library is used by applications such as GIMP and ImageMagick.
Vulnerability Detail
The libwmf package is affected by a vulnerability that allows for a double free in the gdImage*Ptr in gd_gif_out.c, gd_jpeg.c, and gd_wbmp.c. This vulnerability is identified as CVE-2019-6978. Exploitation of this vulnerability could lead to arbitrary code execution or denial of service attacks.
How To Fix
Minimum fixed version
0.2.9-8.el8_0
This is the first release that contains the fix.
sudo dnf update libwmfTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The libwmf package is affected by a double free vulnerability that can result in arbitrary code execution or denial of service attacks. It is recommended to update the libwmf package to version 0.2.9-8.el8_0 or later to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for libwmf →
FAQ
Libwmf is a library used for reading and converting Windows Metafile Format (WMF) vector graphics.
Applications such as GIMP and ImageMagick utilize libwmf for handling WMF files.
The vulnerability allows for a double free, which can lead to arbitrary code execution or denial of service attacks.
The CVE identifier for this vulnerability is CVE-2019-6978.
To fix this vulnerability, update the libwmf package to version 0.2.9-8.el8_0 or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for libwmf.
