PT-2009-1069 · Libwmf+4 · Libwmf+5

Tavis Ormandy · Published 2009-04-30 · Updated 2025-09-03 · CVE-2009-1364

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions libwmf versions 0.2.8.3 through 0.2.8.4 libwmf-devel versions 0.2.8.3 through 0.2.8.4

Description The issue is related to a use-after-free vulnerability in the embedded GD library in libwmf, which allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted WMF file. This vulnerability can be exploited remotely and may lead to a violation of confidentiality, integrity, and availability of protected information.

Recommendations For libwmf versions 0.2.8.3 through 0.2.8.4, update to a version that contains a fix for this vulnerability. For libwmf-devel versions 0.2.8.3 through 0.2.8.4, update to a version that contains a fix for this vulnerability. As a temporary workaround, consider restricting the use of libwmf and libwmf-devel until a patch is available.

Fix

Related Identifiers

ALT-PU-2025-10401

ALT-PU-2025-11012

BDU:2015-07399

BDU:2015-07400

BDU:2015-07401

BDU:2015-07402

BDU:2015-08513

BDU:2015-08514

BDU:2015-08515

BDU:2015-08516

CVE-2009-1364

DSA-1796-1

RHSA-2009:0457

RHSA-2009_0457

SUSE-SU-2015:1484-1

SUSE-SU-2015_1484-1

Affected Products

Alt Linux

Gd Library

Red Hat

Suse

Libwmf

Libwmf-Devel

References · 75

• http://mandriva.com/security/advisories?name=MDVSA-2009:106 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-08514 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-1364 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4696 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2009-1364 · Security Note
• https://bdu.fstec.ru/vul/2015-08515 · Security Note
• https://redhat.com/archives/fedora-package-announce/2009-May/msg01269.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-08516 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2009-1364 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-07399 · Security Note
• https://redhat.com/archives/fedora-package-announce/2009-May/msg01263.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3376 · Security Note
• https://bdu.fstec.ru/vul/2015-08513 · Security Note
• http://rhn.redhat.com/errata/RHSA-2009-0457.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2009-1364 · Vendor Advisory