CVE-2016-9011: Buffer Overflow
A memory allocation failure in function wmfmalloc in api.c was reported in libwmf. Opening a maliciously crafted file could cause the application to crash.
References:
http://seclists.org/oss-sec/2016/q4/176
External References:
https://blogs.gentoo.org/ago/2016/10/18/libwmf-memory-allocation-failure-in-wmfmalloc-api-c/
Other sources
The wmfmalloc function in api.c in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (application crash) via a crafted wmf file, which triggers a memory allocation failure.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-9011?
CVE-2016-9011 is classified with a moderate severity due to its potential to cause application crashes.
How do I fix CVE-2016-9011?
To fix CVE-2016-9011, update libwmf to version 0.2.8.5 or later where the vulnerability is patched.
What does CVE-2016-9011 affect?
CVE-2016-9011 affects libwmf, specifically version 0.2.8.4, and allows the application to crash when processing malicious files.
What are the consequences of exploiting CVE-2016-9011?
Exploiting CVE-2016-9011 can lead to a denial of service (DoS) as the application crashes upon handling a crafted file.
Is CVE-2016-9011 easy to exploit?
CVE-2016-9011 can be considered easy to exploit as it requires a specially crafted file to trigger the memory allocation failure.