| Name | CVE-2006-3376 |
| Description | Integer overflow in player.c in libwmf 0.2.8.4, as used in multiple products including (1) wv, (2) abiword, (3) freetype, (4) gimp, (5) libgsf, and (6) imagemagick allows remote attackers to execute arbitrary code via the MaxRecordSize header field in a WMF file. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| References | DSA-1194-1 |
| Debian Bugs | 381538 |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| libwmf (PTS) | bullseye | 0.2.8.4-17 | fixed |
| bookworm | 0.2.12-5.1 | fixed | |
| sid, trixie | 0.2.13-1.1 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| libwmf | source | sarge | 0.2.8.3-2sarge1 | DSA-1194-1 | ||
| libwmf | source | (unstable) | 0.2.8.4-2 | medium | 381538 |