CVE-2015-4588
Heap-based buffer overflow in the DecodeImage function in libwmf 0.2.8.4 allows remote attackers...
CVE-2015-4588 is a medium vulnerability (CVSS 6.8) in Wvware Libwmf, published June 26, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 9.16%, the 95th percentile. Fixed in libwmf 0.2.8.4-10.4.
- Severity
- 6.8 MediumCVSS 2.0, NVD
- Exploit chance
- 9.16%EPSS, 95th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
0.2.8.4-10.4libwmf +48 more
Description
Heap-based buffer overflow in the DecodeImage function in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted "run-length count" in an image in a WMF file.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libwmfDebian:12 | before 0.2.8.4-10.4 | 0.2.8.4-10.4 |
libwmfDebian:13 | before 0.2.8.4-10.4 | 0.2.8.4-10.4 |
libwmfDebian:14 | before 0.2.8.4-10.4 | 0.2.8.4-10.4 |
libwmfDebian:6.0 From an advisory covering 2 CVEs | before 0.2.8.4-6.2+deb6u1, plus listed versions 0.2.8.4-6.1 | 0.2.8.4-6.2+deb6u1 |
libwmfDebian:7 From an advisory covering 4 CVEs | before 0.2.8.4-10.3+deb7u1, plus listed versions 0.2.8.4-10.3 | 0.2.8.4-10.3+deb7u1 |
libwmfDebian:8 From an advisory covering 4 CVEs | before 0.2.8.4-10.3+deb8u1, plus listed versions 0.2.8.4-10.3 | 0.2.8.4-10.3+deb8u1 |
libwmfMageia:4 From an advisory covering 4 CVEs | before 0.2.8.4-30.2.mga4 | 0.2.8.4-30.2.mga4 |
libwmfMageia:5 From an advisory covering 4 CVEs | before 0.2.8.4-32.2.mga5 | 0.2.8.4-32.2.mga5 |
libwmfRed Hat:enterprise_linux:6::client From an advisory covering 4 CVEs | before 0:0.2.8.4-25.el6_7 | 0:0.2.8.4-25.el6_7 |
libwmf-debuginfoRed Hat:enterprise_linux:6::client From an advisory covering 4 CVEs | before 0:0.2.8.4-25.el6_7 | 0:0.2.8.4-25.el6_7 |
Show 39 moreShow less
| Package | Affected | Fixed |
|---|---|---|
libwmf-liteRed Hat:enterprise_linux:6::client From an advisory covering 4 CVEs | before 0:0.2.8.4-25.el6_7 | 0:0.2.8.4-25.el6_7 |
libwmf-develRed Hat:enterprise_linux:6::client From an advisory covering 4 CVEs | before 0:0.2.8.4-25.el6_7 | 0:0.2.8.4-25.el6_7 |
libwmfRed Hat:enterprise_linux:6::computenode From an advisory covering 4 CVEs | before 0:0.2.8.4-25.el6_7 | 0:0.2.8.4-25.el6_7 |
libwmf-debuginfoRed Hat:enterprise_linux:6::computenode From an advisory covering 4 CVEs | before 0:0.2.8.4-25.el6_7 | 0:0.2.8.4-25.el6_7 |
libwmf-develRed Hat:enterprise_linux:6::computenode From an advisory covering 4 CVEs | before 0:0.2.8.4-25.el6_7 | 0:0.2.8.4-25.el6_7 |
libwmf-liteRed Hat:enterprise_linux:6::computenode From an advisory covering 4 CVEs | before 0:0.2.8.4-25.el6_7 | 0:0.2.8.4-25.el6_7 |
libwmfRed Hat:enterprise_linux:6::server From an advisory covering 4 CVEs | before 0:0.2.8.4-25.el6_7 | 0:0.2.8.4-25.el6_7 |
libwmf-debuginfoRed Hat:enterprise_linux:6::server From an advisory covering 4 CVEs | before 0:0.2.8.4-25.el6_7 | 0:0.2.8.4-25.el6_7 |
libwmf-liteRed Hat:enterprise_linux:6::server From an advisory covering 4 CVEs | before 0:0.2.8.4-25.el6_7 | 0:0.2.8.4-25.el6_7 |
libwmf-develRed Hat:enterprise_linux:6::server From an advisory covering 4 CVEs | before 0:0.2.8.4-25.el6_7 | 0:0.2.8.4-25.el6_7 |
libwmfRed Hat:enterprise_linux:6::workstation From an advisory covering 4 CVEs | before 0:0.2.8.4-25.el6_7 | 0:0.2.8.4-25.el6_7 |
libwmf-debuginfoRed Hat:enterprise_linux:6::workstation From an advisory covering 4 CVEs | before 0:0.2.8.4-25.el6_7 | 0:0.2.8.4-25.el6_7 |
libwmf-liteRed Hat:enterprise_linux:6::workstation From an advisory covering 4 CVEs | before 0:0.2.8.4-25.el6_7 | 0:0.2.8.4-25.el6_7 |
libwmf-develRed Hat:enterprise_linux:6::workstation From an advisory covering 4 CVEs | before 0:0.2.8.4-25.el6_7 | 0:0.2.8.4-25.el6_7 |
libwmfRed Hat:enterprise_linux:7::client From an advisory covering 4 CVEs | before 0:0.2.8.4-41.el7_1 | 0:0.2.8.4-41.el7_1 |
libwmf-debuginfoRed Hat:enterprise_linux:7::client From an advisory covering 4 CVEs | before 0:0.2.8.4-41.el7_1 | 0:0.2.8.4-41.el7_1 |
libwmf-liteRed Hat:enterprise_linux:7::client From an advisory covering 4 CVEs | before 0:0.2.8.4-41.el7_1 | 0:0.2.8.4-41.el7_1 |
libwmf-develRed Hat:enterprise_linux:7::client From an advisory covering 4 CVEs | before 0:0.2.8.4-41.el7_1 | 0:0.2.8.4-41.el7_1 |
libwmfRed Hat:enterprise_linux:7::computenode From an advisory covering 4 CVEs | before 0:0.2.8.4-41.el7_1 | 0:0.2.8.4-41.el7_1 |
libwmf-debuginfoRed Hat:enterprise_linux:7::computenode From an advisory covering 4 CVEs | before 0:0.2.8.4-41.el7_1 | 0:0.2.8.4-41.el7_1 |
libwmf-develRed Hat:enterprise_linux:7::computenode From an advisory covering 4 CVEs | before 0:0.2.8.4-41.el7_1 | 0:0.2.8.4-41.el7_1 |
libwmf-liteRed Hat:enterprise_linux:7::computenode From an advisory covering 4 CVEs | before 0:0.2.8.4-41.el7_1 | 0:0.2.8.4-41.el7_1 |
libwmfRed Hat:enterprise_linux:7::server From an advisory covering 4 CVEs | before 0:0.2.8.4-41.el7_1 | 0:0.2.8.4-41.el7_1 |
libwmf-debuginfoRed Hat:enterprise_linux:7::server From an advisory covering 4 CVEs | before 0:0.2.8.4-41.ael7b_1 | 0:0.2.8.4-41.ael7b_1 |
libwmf-liteRed Hat:enterprise_linux:7::server From an advisory covering 4 CVEs | before 0:0.2.8.4-41.ael7b_1 | 0:0.2.8.4-41.ael7b_1 |
libwmf-develRed Hat:enterprise_linux:7::server From an advisory covering 4 CVEs | before 0:0.2.8.4-41.ael7b_1 | 0:0.2.8.4-41.ael7b_1 |
libwmfRed Hat:enterprise_linux:7::workstation From an advisory covering 4 CVEs | before 0:0.2.8.4-41.el7_1 | 0:0.2.8.4-41.el7_1 |
libwmf-debuginfoRed Hat:enterprise_linux:7::workstation From an advisory covering 4 CVEs | before 0:0.2.8.4-41.el7_1 | 0:0.2.8.4-41.el7_1 |
libwmf-liteRed Hat:enterprise_linux:7::workstation From an advisory covering 4 CVEs | before 0:0.2.8.4-41.el7_1 | 0:0.2.8.4-41.el7_1 |
libwmf-develRed Hat:enterprise_linux:7::workstation From an advisory covering 4 CVEs | before 0:0.2.8.4-41.el7_1 | 0:0.2.8.4-41.el7_1 |
libwmfSUSE:Linux Enterprise Software Development Kit 11 SP3 From an advisory covering 4 CVEs | before 0.2.8.4-206.29.29.1 | 0.2.8.4-206.29.29.1 |
libwmfSUSE:Linux Enterprise Software Development Kit 11 SP4 From an advisory covering 4 CVEs | before 0.2.8.4-206.29.29.1 | 0.2.8.4-206.29.29.1 |
libwmfSUSE:Linux Enterprise Desktop 11 SP3 From an advisory covering 4 CVEs | before 0.2.8.4-206.29.29.1 | 0.2.8.4-206.29.29.1 |
libwmfSUSE:Linux Enterprise Desktop 11 SP4 From an advisory covering 4 CVEs | before 0.2.8.4-206.29.29.1 | 0.2.8.4-206.29.29.1 |
libwmfSUSE:Linux Enterprise Desktop 12 From an advisory covering 5 CVEs | before 0.2.8.4-242.3 | 0.2.8.4-242.3 |
libwmfSUSE:Linux Enterprise Software Development Kit 12 From an advisory covering 5 CVEs | before 0.2.8.4-242.3 | 0.2.8.4-242.3 |
libwmfSUSE:Linux Enterprise Workstation Extension 12 From an advisory covering 5 CVEs | before 0.2.8.4-242.3 | 0.2.8.4-242.3 |
libwmfUbuntu:14.04:LTS | before 0.2.8.4-10.3ubuntu1.14.04.1, plus listed versions 0.2.8.4-10.3ubuntu1 | 0.2.8.4-10.3ubuntu1.14.04.1 |
libwmfUbuntu:14.04:LTS From an advisory covering 4 CVEs | before 0.2.8.4-10.3ubuntu1.14.04.1, plus listed versions 0.2.8.4-10.3ubuntu1 | 0.2.8.4-10.3ubuntu1.14.04.1 |
What each source reports
NVD Score used
Heap-based buffer overflow in the DecodeImage function in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted "run-length count" in an image in a WMF file.
- Record
CVE-2015-4588- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE ListNo score
Heap-based buffer overflow in the DecodeImage function in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted "run-length count" in an image in a WMF file.
- Record
CVE-2015-4588- Updated
- 2026-11-02
EUVDEUVD-2015-4608No score
Heap-based buffer overflow in the DecodeImage function in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted "run-length count" in an image in a WMF file.
- Record
EUVD-2015-4608- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-v3qj-6mjm-fxx7No score
Heap-based buffer overflow in the DecodeImage function in libwmf 0.2.8.4 allows remote attackers...
Heap-based buffer overflow in the DecodeImage function in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted "run-length count" in an image in a WMF file.
- Record
GHSA-v3qj-6mjm-fxx7- Weakness
- CWE-119
- Updated
- 2026-11-02
OSVNo score
Heap-based buffer overflow in the DecodeImage function in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted "run-length count" in an image in a WMF file.
- Record
CVE-2015-4588- Updated
- 2026-11-02
OSVDEBIAN-CVE-2015-4588No score
Heap-based buffer overflow in the DecodeImage function in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted "run-length count" in an image in a WMF file.
- Record
DEBIAN-CVE-2015-4588- Updated
- 2026-11-02
Show 6 moreShow less
OSVMGASA-2015-0261No score
Updated libwmf package fixes security vulnerability
It was discovered that libwmf did not correctly process certain WMF (Windows Metafiles) containing BMP images. By tricking a victim into opening a specially crafted WMF file in an application using libwmf, a remote attacker could possibly use this flaw to execute arbitrary code with the privileges of the user running the application (CVE-2015-0848, CVE-2015-4588).
Two out of bounds reads in libwmf were also discovered, one in the meta_pen_create() function in player/meta.h (CVE-2015-4695) and one in wmf2gd.c and wmf2eps.c (CVE-2015-4696)
- Record
MGASA-2015-0261- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10337-1No score
libwmf-0_2-7-0.2.8.4-243.7 on GA media
These are all security issues fixed in the libwmf-0_2-7-0.2.8.4-243.7 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10337-1- Updated
- 2026-11-02
OSVSUSE-SU-2015:1378-1No score
Security update for libwmf
libwmf was updated to fix four security issues.
These security issues were fixed:
- CVE-2015-4588: Heap-based buffer overflow in the DecodeImage function allowed remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted 'run-length count' in an image in a WMF file (bsc#933109).
- CVE-2015-0848: Heap-based buffer overflow allowed remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted BMP image (bsc#933109).
- CVE-2015-4696: Use-after-free vulnerability allowed remote attackers to cause a denial of service (crash) via a crafted WMF file to the (1) wmf2gd or (2) wmf2eps command (bsc#936062).
- CVE-2015-4695: meta.h allowed remote attackers to cause a denial of service (out-of-bounds read) via a crafted WMF file (bsc#936058).
- Record
SUSE-SU-2015:1378-1- Updated
- 2026-11-02
OSVSUSE-SU-2015:1484-1No score
Security update for libwmf
libwmf was updated to fix five security issues.
These security issues were fixed:
- CVE-2009-1364: Fixed realloc return value usage (bsc#495842, bnc#831299)
- CVE-2015-0848: Heap overflow on libwmf0.2-7 (bsc#933109)
- CVE-2015-4588: DecodeImage() did not check that the run-length 'count' fits into the total size of the image, which could lead to a heap-based buffer overflow (bsc#933109)
- CVE-2015-4695: meta_pen_create heap buffer over read (bsc#936058)
- CVE-2015-4696: Use after free (bsc#936062)
- Record
SUSE-SU-2015:1484-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-4588No score
Heap-based buffer overflow in the DecodeImage function in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted "run-length count" in an image in a WMF file.
- Record
UBUNTU-CVE-2015-4588- Updated
- 2026-11-02
OSVUSN-2670-1No score
libwmf vulnerabilities
Fernando Muñoz and Stefan Cornelius discovered that libwmf incorrectly handled certain malformed images. If a user or automated system were tricked into opening a crafted image file, an attacker could cause a denial of service or execute arbitrary code with privileges of the user invoking the program.
- Record
USN-2670-1- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
debian.org/security/2015/dsa-3302
openwall.com/lists/oss-security/2015/06/03/6
lists.opensuse.org/opensuse-updates/2015-06/msg00051.html
security.gentoo.org/glsa/201602-03
lists.fedoraproject.org/pipermail/package-announce/2015-June/160668.html
oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
Show 48 moreShow less
ubuntu.com/usn/USN-2670-1
bugzilla.redhat.com/show_bug.cgi?id=1227243
securityfocus.com/bid/75230
securitytracker.com/id/1032771
rhn.redhat.com/errata/RHSA-2015-1917.html
nvd.nist.gov/vuln/detail/CVE-2015-4588
github.com/advisories/GHSA-v3qj-6mjm-fxx7
security-tracker.debian.org/tracker/CVE-2015-4588
advisories.mageia.org/MGASA-2015-0261.html
bugs.mageia.org/show_bug.cgi?id=16127
openwall.com/lists/oss-security/2015/06/21/3
access.redhat.com/errata/RHSA-2015:1917
security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1917.json
cve.org/CVERecord?id=CVE-2015-0848
suse.com/support/update/announcement/2015/suse-su-20151378-1
bugzilla.suse.com/831299
ubuntu.com/security/CVE-2015-4588