{"id":"CVE-2006-3376","aliases":["DEBIAN-CVE-2006-3376","DSA-1194-1","EUVD-2006-3372","GHSA-gm5p-fx2g-h9h3","RHSA-2006:0597","openSUSE-SU-2024:11012-1"],"status":"published","title":"Integer overflow in player.c in libwmf 0.2.8.4, as used in multiple products including (1) wv, (2...","description":"Integer overflow in player.c in libwmf 0.2.8.4, as used in multiple products including (1) wv, (2) abiword, (3) freetype, (4) gimp, (5) libgsf, and (6) imagemagick allows remote attackers to execute arbitrary code via the MaxRecordSize header field in a WMF file.","severity":{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.07678,"percentile":0.94626,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2006-07-06T20:00:00Z","modified":"2026-10-22T23:47:25Z","fixes":[{"ecosystem":"Debian:12","package":"libwmf","fixed_in":["0.2.8.4-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libwmf","fixed_in":["0.2.8.4-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libwmf","fixed_in":["0.2.8.4-2"],"sources":["osv"]},{"ecosystem":"Debian:3.1","package":"libwmf","fixed_in":["0.2.8.3-2sarge1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::as","package":"libwmf","fixed_in":["0:0.2.8.3-5.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::as","package":"libwmf-debuginfo","fixed_in":["0:0.2.8.3-5.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::as","package":"libwmf-devel","fixed_in":["0:0.2.8.3-5.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"libwmf","fixed_in":["0:0.2.8.3-5.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"libwmf-debuginfo","fixed_in":["0:0.2.8.3-5.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"libwmf-devel","fixed_in":["0:0.2.8.3-5.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::es","package":"libwmf","fixed_in":["0:0.2.8.3-5.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::es","package":"libwmf-debuginfo","fixed_in":["0:0.2.8.3-5.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::es","package":"libwmf-devel","fixed_in":["0:0.2.8.3-5.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::ws","package":"libwmf","fixed_in":["0:0.2.8.3-5.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::ws","package":"libwmf-debuginfo","fixed_in":["0:0.2.8.3-5.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::ws","package":"libwmf-devel","fixed_in":["0:0.2.8.3-5.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libwmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.8.4-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libwmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.8.4-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libwmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.8.4-2"}]}]},{"source":"osv","ecosystem":"Debian:3.1","package":"libwmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.8.3-2sarge1"}]}],"versions":["0.2.8.3-2"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::as","package":"libwmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.2.8.3-5.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::as","package":"libwmf-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.2.8.3-5.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::as","package":"libwmf-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.2.8.3-5.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"libwmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.2.8.3-5.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"libwmf-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.2.8.3-5.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"libwmf-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.2.8.3-5.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::es","package":"libwmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.2.8.3-5.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::es","package":"libwmf-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.2.8.3-5.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::es","package":"libwmf-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.2.8.3-5.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::ws","package":"libwmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.2.8.3-5.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::ws","package":"libwmf-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.2.8.3-5.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::ws","package":"libwmf-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.2.8.3-5.3"}]}]}],"products":[{"vendor":"wvware","product":"libwmf"},{"vendor":"wvware","product":"wv2"}],"references":[{"url":"http://www.securityfocus.com/archive/1/438803/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","web"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10262","tags":["vdb-entry","signature","x_refsource_OVAL","x_transferred","web"]},{"url":"http://secunia.com/advisories/20921","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/27516","tags":["vdb-entry","x_refsource_XF","x_transferred","web"]},{"url":"http://securitytracker.com/id?1016518","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"http://secunia.com/advisories/21473","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/22311","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://www.ubuntu.com/usn/usn-333-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"http://securityreason.com/securityalert/1190","tags":["third-party-advisory","x_refsource_SREASON","x_transferred","web"]},{"url":"http://secunia.com/advisories/21459","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://www.securityfocus.com/bid/18751","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://www.novell.com/linux/security/advisories/2006_19_sr.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/21064","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://www.vupen.com/english/advisories/2006/2646","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","advisory"]},{"url":"https://www.debian.org/security/2006/dsa-1194","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/21261","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://www.mandriva.com/security/advisories?name=MDKSA-2006:132","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/21419","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2006-0597.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"http://security.gentoo.org/glsa/glsa-200608-17.xml","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2006-3376","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-gm5p-fx2g-h9h3"},{"url":"https://security-tracker.debian.org/tracker/CVE-2006-3376","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2006:0597","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=198290","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2006/rhsa-2006_0597.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2006-3376","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1618139","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2006-3376","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2006-3376","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6978","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2006-3376","description":"Integer overflow in player.c in libwmf 0.2.8.4, as used in multiple products including (1) wv, (2) abiword, (3) freetype, (4) gimp, (5) libgsf, and (6) imagemagick allows remote attackers to execute arbitrary code via the MaxRecordSize header field in a WMF file.","status":"published","published":"2006-07-06T20:00:00Z","modified":"2024-08-07T18:23:21.282Z","updated_at":"2026-11-02T14:33:49.265317Z"}],"euvd":[{"id":"EUVD-2006-3372","description":"Integer overflow in player.c in libwmf 0.2.8.4, as used in multiple products including (1) wv, (2) abiword, (3) freetype, (4) gimp, (5) libgsf, and (6) imagemagick allows remote attackers to execute arbitrary code via the MaxRecordSize header field in a WMF file.","status":"published","published":"2006-07-06T20:00:00Z","modified":"2024-08-07T18:23:21Z","updated_at":"2026-11-03T01:15:56.778843Z"}],"ghsa":[{"id":"GHSA-gm5p-fx2g-h9h3","title":"Integer overflow in player.c in libwmf 0.2.8.4, as used in multiple products including (1) wv, (2...","description":"Integer overflow in player.c in libwmf 0.2.8.4, as used in multiple products including (1) wv, (2) abiword, (3) freetype, (4) gimp, (5) libgsf, and (6) imagemagick allows remote attackers to execute arbitrary code via the MaxRecordSize header field in a WMF file.","status":"published","published":"2022-05-01T07:08:26Z","modified":"2023-01-31T05:01:30Z","updated_at":"2026-11-02T14:48:04.351357Z"}],"nvd":[{"id":"CVE-2006-3376","description":"Integer overflow in player.c in libwmf 0.2.8.4, as used in multiple products including (1) wv, (2) abiword, (3) freetype, (4) gimp, (5) libgsf, and (6) imagemagick allows remote attackers to execute arbitrary code via the MaxRecordSize header field in a WMF file.","status":"published","published":"2006-07-06T20:05:00Z","modified":"2026-06-16T22:26:56.557Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:01:04.288594Z"}],"osv":[{"id":"CVE-2006-3376","description":"Integer overflow in player.c in libwmf 0.2.8.4, as used in multiple products including (1) wv, (2) abiword, (3) freetype, (4) gimp, (5) libgsf, and (6) imagemagick allows remote attackers to execute arbitrary code via the MaxRecordSize header field in a WMF file.","status":"published","published":"2006-07-06T20:05:00Z","modified":"2026-04-10T03:37:37.319459Z","updated_at":"2026-11-02T15:43:56.581247Z"},{"id":"DEBIAN-CVE-2006-3376","description":"Integer overflow in player.c in libwmf 0.2.8.4, as used in multiple products including (1) wv, (2) abiword, (3) freetype, (4) gimp, (5) libgsf, and (6) imagemagick allows remote attackers to execute arbitrary code via the MaxRecordSize header field in a WMF file.","status":"published","published":"2006-07-06T20:05:00Z","modified":"2026-10-22T23:47:25.012312878Z","updated_at":"2026-11-02T15:45:23.105674Z"},{"id":"DSA-1194-1","title":"libwmf","status":"published","published":"2006-10-09T00:00:00Z","modified":"2026-03-09T01:00:54.663185Z","updated_at":"2026-11-02T15:46:14.285228Z"},{"id":"openSUSE-SU-2024:11012-1","title":"libwmf-0_2-7-0.2.12-2.3 on GA media","description":"These are all security issues fixed in the libwmf-0_2-7-0.2.12-2.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:08:19.595133Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"RHSA-2006:0597","title":"Red Hat Security Advisory: libwmf security update","status":"published","published":"2024-09-15T16:16:54Z","modified":"2026-06-26T10:04:49Z","updated_at":"2026-11-02T15:52:59.135214Z"}]}}