UnratedFix available
libwmf — security advisory
Integer overflow in player.c in libwmf 0.2.8.4, as used in multiple products including (1) wv, (2) abiword, (3) freetype, (4) gimp, (5) libgsf, and (6) imagemagick allows remote attackers to execute arbitrary code via the MaxRecordSize header field in a WMF file.
- Products
- libwmf
- Affected versions
- Not specified
- Fixed versions
- 0.2.8.4-2
- CVEs
- CVE-2006-3376
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 20:13 UTC · Revision 1
Source evidence
Integer overflow in player.c in libwmf 0.2.8.4, as used in multiple products including (1) wv, (2) abiword, (3) freetype, (4) gimp, (5) libgsf, and (6) imagemagick allows remote attackers to execute arbitrary code via the MaxRecordSize header field in a WMF file.
osv:DEBIAN-CVE-2006-3376
libwmf
Fixed versions: 0.2.8.4-2
libwmf
Fixed versions: 0.2.8.4-2
libwmf
Fixed versions: 0.2.8.4-2
Complete source record
{
"id": "e30f4f19405e7813dba8124e43f60be5c55d428986093721440f7bf60fe673c9",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2006-3376",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2006-3376",
"summary": "Integer overflow in player.c in libwmf 0.2.8.4, as used in multiple products including (1) wv, (2) abiword, (3) freetype, (4) gimp, (5) libgsf, and (6) imagemagick allows remote attackers to execute arbitrary code via the MaxRecordSize header field in a WMF file.",
"evidence": "osv:DEBIAN-CVE-2006-3376",
"products": [
{
"name": {
"value": "libwmf",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0.2.8.4-2",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libwmf",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0.2.8.4-2",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libwmf",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0.2.8.4-2",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "DEBIAN-CVE-2006-3376",
"aliases": [
"DEBIAN-CVE-2006-3376"
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.2.8.4-2"
}
]
}
],
"package": {
"name": "libwmf",
"purl": "pkg:deb/debian/libwmf?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2006-3376.json"
},
"ecosystem_specific": {
"urgency": "medium"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.2.8.4-2"
}
]
}
],
"package": {
"name": "libwmf",
"purl": "pkg:deb/debian/libwmf?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2006-3376.json"
},
"ecosystem_specific": {
"urgency": "medium"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.2.8.4-2"
}
]
}
],
"package": {
"name": "libwmf",
"purl": "pkg:deb/debian/libwmf?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2006-3376.json"
},
"ecosystem_specific": {
"urgency": "medium"
}
}
],
"modified": "2026-10-22T23:47:25.012312878Z",
"provider": "osv",
"upstream": [
"CVE-2006-3376"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2006-3376"
]
},
"related_cves": [
{
"value": "CVE-2006-3376",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 410473,
"published_at": "2006-07-06T20:05:00+00:00"
}