blob: be6b5c02a89f4ddd8cb278725465c64800f8ec28 [file] [log] [blame]
<?xml version="1.0" encoding="utf-8"?>
<glsa id="200601-09">
<title>Wine: Windows Metafile SETABORTPROC vulnerability</title>
There is a flaw in Wine in the handling of Windows Metafiles (WMF) files,
which could possibly result in the execution of arbitrary code.
<product type="ebuild">wine</product>
<announced>January 13, 2006</announced>
<revised>February 26, 2007: 03</revised>
<package name="app-emulation/wine" auto="yes" arch="*">
<unaffected range="ge">0.9</unaffected>
<vulnerable range="lt">20060000</vulnerable>
<vulnerable range="gt">20040000</vulnerable>
Wine is a free implementation of Windows APIs for Unix-like systems.
H D Moore discovered that Wine implements the insecure-by-design
SETABORTPROC GDI Escape function for Windows Metafile (WMF) files.
<impact type="normal">
An attacker could entice a user to open a specially crafted Windows
Metafile (WMF) file from within a Wine executed Windows application,
possibly resulting in the execution of arbitrary code with the rights
of the user running Wine.
There is no known workaround at this time.
All Wine users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose &quot;&gt;=app-emulation/wine-0.9.0&quot;</code>
<uri link="">CVE-2006-0106</uri>
<metadata tag="requester" timestamp="Sun, 08 Jan 2006 16:28:07 +0000">
<metadata tag="bugReady" timestamp="Sun, 08 Jan 2006 17:43:07 +0000">
<metadata tag="submitter" timestamp="Thu, 12 Jan 2006 08:25:50 +0000">