CVE-2009-1364

Description

Use-after-free vulnerability in the embedded GD library in libwmf 0.2.8.4 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted WMF file.

7.5

CVSS

Severity: High

CVSS 2.0 •

EPSS 3.15% Top 15%

Vendor Advisory redhat.com Vendor Advisory opensuse.org Vendor Advisory redhat.com Vendor Advisory opensuse.org Vendor Advisory redhat.com Vendor Advisory opensuse.org Vendor Advisory gentoo.org Vendor Advisory redhat.com Vendor Advisory debian.org Vendor Advisory ubuntu.com Vendor Advisory mandriva.com

Affected: n/a n/a

References

Link	Tags
http://rhn.redhat.com/errata/RHSA-2009-0457.html	vendor advisory
http://secunia.com/advisories/34964	third party advisory
http://secunia.com/advisories/35001	third party advisory
http://secunia.com/advisories/35190	third party advisory
https://launchpad.net/bugs/cve/2009-1364
http://lists.opensuse.org/opensuse-updates/2015-06/msg00051.html	vendor advisory
https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01266.html	vendor advisory
http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html	vendor advisory
https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01263.html	vendor advisory
https://bugzilla.redhat.com/show_bug.cgi?id=496864
http://wvware.cvs.sourceforge.net/viewvc/wvware/libwmf2/src/extra/Makefile.am?hideattic=0&view=log
http://lists.opensuse.org/opensuse-updates/2015-06/msg00053.html	vendor advisory
http://secunia.com/advisories/35686	third party advisory
http://www.securitytracker.com/id?1022154	vdb entry
http://secunia.com/advisories/34901	third party advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10959	signature vdb entry
http://security.gentoo.org/glsa/glsa-200907-01.xml	vendor advisory
http://secunia.com/advisories/35416	third party advisory
https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01269.html	vendor advisory
http://www.debian.org/security/2009/dsa-1796	vendor advisory
http://www.securityfocus.com/bid/34792	vdb entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/50290	vdb entry
http://secunia.com/advisories/35025	third party advisory
http://www.ubuntu.com/usn/USN-769-1	vendor advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2009:106	vendor advisory
http://www.vupen.com/english/advisories/2009/1228	vdb entry

Frequently Asked Questions

What is the severity of CVE-2009-1364?: CVE-2009-1364 has been scored as a high severity vulnerability.
How to fix CVE-2009-1364?: To fix CVE-2009-1364, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2009-1364 being actively exploited in the wild?: It is possible that CVE-2009-1364 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~3% probability that this vulnerability will be exploited by malicious actors in the next 30 days.