CVE-2018-12932

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

PlayEnhMetaFileRecord in enhmetafile.c in Wine 3.7 allows attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact by triggering a large pAlphaBlend->cbBitsSrc value.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://bugs.launchpad.net/ubuntu/+source/wine/+bug/1764719Issue Tracking, Third Party Advisory
https://bugs.winehq.org/attachment.cgi?id=61284Issue Tracking, Patch, Third Party Advisory
https://bugs.winehq.org/show_bug.cgi?id=45105Issue Tracking, Patch, Third Party Advisory
https://source.winehq.org/git/wine.git/commit/8d2676fd14f130f9e8f06744743423168bf8d18dIssue Tracking, Patch, Third Party Advisory
https://source.winehq.org/git/wine.git/commit/b6da3547d8990c3c3affc3a5865aefd2a0946949Issue Tracking, Patch, Third Party Advisory
https://bugs.launchpad.net/ubuntu/+source/wine/+bug/1764719Issue Tracking, Third Party Advisory
https://bugs.winehq.org/attachment.cgi?id=61284Issue Tracking, Patch, Third Party Advisory
https://bugs.winehq.org/show_bug.cgi?id=45105Issue Tracking, Patch, Third Party Advisory
https://source.winehq.org/git/wine.git/commit/8d2676fd14f130f9e8f06744743423168bf8d18dIssue Tracking, Patch, Third Party Advisory
https://source.winehq.org/git/wine.git/commit/b6da3547d8990c3c3affc3a5865aefd2a0946949Issue Tracking, Patch, Third Party Advisory

Timeline

Published: Jun 28, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-129339.8PlayEnhMetaFileRecord in enhmetafile.c in Wine 3.7 allows attackers to cause a denial of service (out-of-bounds write) or possibly have unsp CVE-2018-129347.5remember_Ktype in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30, allows attackers to trigger excessive memory consumptio CVE-2018-129396.5A directory traversal flaw in SeedDMS (formerly LetoDMS and MyDMS) before 5.1.8 allows an authenticated attacker to write to (or potentially CVE-2018-12947.5If a user of Apache Commons Email (typically an application programmer) passes unvalidated input as the so-called "Bounce Address", and that CVE-2018-129408.8Unrestricted file upload vulnerability in "op/op.UploadChunks.php" in SeedDMS (formerly LetoDMS and MyDMS) before 5.1.8 allows remote attack CVE-2018-129418.8This vulnerability allows remote attackers to execute arbitrary code in SeedDMS (formerly LetoDMS and MyDMS) before 5.1.8 by adding a system CVE-2018-129428.8SQL injection vulnerability in the "Users management" functionality in SeedDMS (formerly LetoDMS and MyDMS) before 5.1.8 allows authenticate CVE-2018-129436.1Cross-Site Scripting (XSS) vulnerability in every page that includes the "action" URL parameter in SeedDMS (formerly LetoDMS and MyDMS) befo CVE-2018-129446.1Persistent Cross-Site Scripting (XSS) vulnerability in the "Categories" feature in SeedDMS (formerly LetoDMS and MyDMS) before 5.1.8 allows CVE-2018-12959.8In Apache Ignite 2.3 or earlier, the serialization mechanism does not have a list of classes allowed for serialization/deserialization, whic CVE-2018-129597.5The approveAndCall function of a smart contract implementation for Aditus (ADI), an Ethereum ERC20 token, allows attackers to steal assets (CVE-2018-12967.5In Apache Hadoop 3.0.0-alpha1 to 3.0.0, 2.9.0, 2.8.0 to 2.8.3, and 2.5.0 to 2.7.5, HDFS exposes extended attribute key/value pairs during li