Integer overflows were reported in the GD Graphics Library (libgd) 2.0.28, and possibly other versions. These overflows allow remote attackers to cause a denial of service and possibly execute arbitrary code via PNG image files with large image rows values that lead to a heap-based buffer overflow in the gdImageCreateFromPngCtx() function. Libwmf contains an embedded copy of the GD library code. (CVE-2004-0990)

Update:

The previous update incorrectly attributed the advisory text to CVE-2004-0941, while it should have been CVE-2004-0990. Additional review of the code found fixes for CVE-2004-0941 were missing and have also been included in this update.

 _______________________________________________________________________
 
 Mandriva Linux Security Advisory                         MDKSA-2006:114
 http://www.mandriva.com/security/
 _______________________________________________________________________
 
 Package : libwmf
 Date    : June 29, 2006
 Affected: 10.2, 2006.0, Corporate 3.0
 _______________________________________________________________________
 
 Problem Description:
 
 Multiple buffer overflows in the gd graphics library (libgd) 2.0.21 and 
 earlier may allow remote attackers to execute arbitrary code via malformed 
 image files that trigger the overflows due to improper calls to the gdMalloc 
 function. (CVE-2004-0941)
 
 Integer overflows were reported in the GD Graphics Library (libgd)
 2.0.28, and possibly other versions. These overflows allow remote
 attackers to  cause a denial of service and possibly execute arbitrary
 code via PNG image files with large image rows values that lead to a
 heap-based buffer overflow in the gdImageCreateFromPngCtx() function. 
 Libwmf contains an embedded copy of the GD library code. (CVE-2004-0990)

 Update:

 The previous update incorrectly attributed the advisory text to
 CVE-2004-0941, while it should have been CVE-2004-0990. Additional
 review of the code found fixes for CVE-2004-0941 were missing and have
 also been included in this update.
 _______________________________________________________________________

 References:
 
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0941
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0990
 _______________________________________________________________________
 
 Updated Packages:
 
 Mandriva Linux 10.2:
 d2f1431abac909a9ed6b861d0d166642  10.2/RPMS/libwmf0.2_7-0.2.8.3-3.2.102mdk.i586.rpm
 158115e0e05d49cb041a5b0909324893  10.2/RPMS/libwmf0.2_7-devel-0.2.8.3-3.2.102mdk.i586.rpm
 c4bb59049046d52bd34489c6cb4dc8d3  10.2/RPMS/libwmf-0.2.8.3-3.2.102mdk.i586.rpm
 6ed1ecc51e46bef4d7a4fdda224bc8c9  10.2/SRPMS/libwmf-0.2.8.3-3.2.102mdk.src.rpm

 Mandriva Linux 10.2/X86_64:
 bef24df30febcd9fe07c264925c65f13  x86_64/10.2/RPMS/lib64wmf0.2_7-0.2.8.3-3.2.102mdk.x86_64.rpm
 ef8b321b1394c79fe981d2a7acd9d0a0  x86_64/10.2/RPMS/lib64wmf0.2_7-devel-0.2.8.3-3.2.102mdk.x86_64.rpm
 7765b8b70dd02273437f4e14bb4402a2  x86_64/10.2/RPMS/libwmf-0.2.8.3-3.2.102mdk.x86_64.rpm
 6ed1ecc51e46bef4d7a4fdda224bc8c9  x86_64/10.2/SRPMS/libwmf-0.2.8.3-3.2.102mdk.src.rpm

 Mandriva Linux 2006.0:
 0235b12476662e421c879603dcced49d  2006.0/RPMS/libwmf0.2_7-0.2.8.3-6.2.20060mdk.i586.rpm
 440d22667b5ab1584d2d99b3bd8da3f7  2006.0/RPMS/libwmf0.2_7-devel-0.2.8.3-6.2.20060mdk.i586.rpm
 5bd72276488aee57d13b2face209600e  2006.0/RPMS/libwmf-0.2.8.3-6.2.20060mdk.i586.rpm
 e3f38ef79f894def30088e68dcc6c012  2006.0/SRPMS/libwmf-0.2.8.3-6.2.20060mdk.src.rpm

 Mandriva Linux 2006.0/X86_64:
 6b0f39e6c7182575a24489da45ec865d  x86_64/2006.0/RPMS/lib64wmf0.2_7-0.2.8.3-6.2.20060mdk.x86_64.rpm
 4d7a9b35233e0f4e0a02bed1823c6479  x86_64/2006.0/RPMS/lib64wmf0.2_7-devel-0.2.8.3-6.2.20060mdk.x86_64.rpm
 ee1f9f5ac47b18e4bdbd21599b58c0ae  x86_64/2006.0/RPMS/libwmf-0.2.8.3-6.2.20060mdk.x86_64.rpm
 e3f38ef79f894def30088e68dcc6c012  x86_64/2006.0/SRPMS/libwmf-0.2.8.3-6.2.20060mdk.src.rpm

 Corporate 3.0:
 2f4b8f42981d6021c8a3be954e116e36  corporate/3.0/RPMS/libwmf0.2_7-0.2.8-6.2.C30mdk.i586.rpm
 cc5352137e837161dd15ef148e277307  corporate/3.0/RPMS/libwmf0.2_7-devel-0.2.8-6.2.C30mdk.i586.rpm
 d1325c5190a117ef995f45e98a59f777  corporate/3.0/RPMS/libwmf-0.2.8-6.2.C30mdk.i586.rpm
 13fd55fcf0446352fc3d620f90f25d16  corporate/3.0/SRPMS/libwmf-0.2.8-6.2.C30mdk.src.rpm

 Corporate 3.0/X86_64:
 5a19ea7a0913022d57bb0457a81119d2  x86_64/corporate/3.0/RPMS/lib64wmf0.2_7-0.2.8-6.2.C30mdk.x86_64.rpm
 6cee6039f9e0ca473ba57c8e22af8181  x86_64/corporate/3.0/RPMS/lib64wmf0.2_7-devel-0.2.8-6.2.C30mdk.x86_64.rpm
 f2cf39399915faf89113ec694e26c24e  x86_64/corporate/3.0/RPMS/libwmf-0.2.8-6.2.C30mdk.x86_64.rpm
 13fd55fcf0446352fc3d620f90f25d16  x86_64/corporate/3.0/SRPMS/libwmf-0.2.8-6.2.C30mdk.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team