134246 – [patch] [vuxml] graphics/libwmf: document and fix two remote code execution vulnerabilities

no flags

Two vulnerabilities (at least) are present in the current FreeBSD's
port graphics/libwmf: [1], [2].

Fix: The following patch fixes both vulnerabilites in the FreeBSD port:

The following VuXML entries should be evaluated and added:
  <vuln vid="8dba4ad9-39b3-11de-a493-001b77d09812">
    <topic>libwmf -- Denial of Service and possible remote code execution</topic>
    <affects>
      <package>
        <name>libwmf</name>
        <range><lt>0.2.8.4_3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
        <p>SecurityFocus reports:</p>
        <blockquote
          cite="http://www.securityfocus.com/bid/34792/discuss">
          <p>The 'libwmf' library is prone to a buffer-overflow
          vulnerability because the vector graphics linked library
          improperly allocates memory when parsing WMF image files.</p>
          <p>Successfully exploiting this issue would allow an attacker
          to corrupt memory and execute arbitrary code in the context of
          the currently logged-in user.</p>
        </blockquote>
      </body>
    </description>
    <references>
      <cvename></cvename>
      <bid>34792</bid>
      <url>http://secunia.com/advisories/34901/</url>
    </references>
    <dates>
      <discovery>2009-05-05</discovery>
      <entry>TODAY</entry>
    </dates>
  </vuln>
--- vuln-1.xml ends here ---
How-To-Repeat: 
[1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1364
[2] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3376