Vulnerability Report

CVE-2006-4514

Title: Libgsf RCE

Memory Corruption

Proof Of Concept

No public PoC currently indexed for CVE-2006-4514.

CWE Category CWE-119

Published Date Nov 30, 2006

Modified Date Apr 23, 2026

Exploit Status Not Found

Score 7.5 CVSS v2.0

Exploit Probability (EPSS)

4.06%

Vulnerability Summary

CVE-2006-4514: Heap-based buffer overflow in the ole_info_read_metabat function in Gnome Structured File library (libgsf) 1.14.0, and other versions before 1.14.2, allows context-dependent attackers to execute arbitrary code via a large num_metabat value in an OLE document, which causes the ole_init_info function to allocate insufficient memory.

Impacted Vendors

libgsf 1

gnome 1

Reference Links

ftp://patches.sgi.com/support/free/security/advisories/20070101-01-P.asc http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=446 http://lists.suse.com/archive/suse-security-announce/2006-Dec/0005.html http://rhn.redhat.com/errata/RHSA-2007-0011.html http://secunia.com/advisories/23164 http://secunia.com/advisories/23166 http://secunia.com/advisories/23167 http://secunia.com/advisories/23227 http://secunia.com/advisories/23337 http://secunia.com/advisories/23352 http://secunia.com/advisories/23355 http://secunia.com/advisories/23686 http://secunia.com/advisories/23920 http://security.gentoo.org/glsa/glsa-200612-13.xml http://www.debian.org/security/2006/dsa-1221 http://www.mandriva.com/security/advisories?name=MDKSA-2006:220 http://www.securityfocus.com/archive/1/454389/30/9210/threaded http://www.securityfocus.com/bid/21358 http://www.ubuntu.com/usn/usn-391-1 http://www.vupen.com/english/advisories/2006/4784 http://www.xerox.com/download/security/security-bulletin/16287-4d6b7b0c81f7b/cert_XRX13-003_v1.0.pdf https://exchange.xforce.ibmcloud.com/vulnerabilities/30611 https://issues.rpath.com/browse/RPL-857 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9413 ftp://patches.sgi.com/support/free/security/advisories/20070101-01-P.asc http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=446 http://lists.suse.com/archive/suse-security-announce/2006-Dec/0005.html http://rhn.redhat.com/errata/RHSA-2007-0011.html http://secunia.com/advisories/23164 http://secunia.com/advisories/23166 http://secunia.com/advisories/23167 http://secunia.com/advisories/23227 http://secunia.com/advisories/23337 http://secunia.com/advisories/23352 http://secunia.com/advisories/23355 http://secunia.com/advisories/23686 http://secunia.com/advisories/23920 http://security.gentoo.org/glsa/glsa-200612-13.xml http://www.debian.org/security/2006/dsa-1221 http://www.mandriva.com/security/advisories?name=MDKSA-2006:220 http://www.securityfocus.com/archive/1/454389/30/9210/threaded http://www.securityfocus.com/bid/21358 http://www.ubuntu.com/usn/usn-391-1 http://www.vupen.com/english/advisories/2006/4784 http://www.xerox.com/download/security/security-bulletin/16287-4d6b7b0c81f7b/cert_XRX13-003_v1.0.pdf https://exchange.xforce.ibmcloud.com/vulnerabilities/30611 https://issues.rpath.com/browse/RPL-857 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9413

CVSS v2.0

Source Entity [email protected]

Severity HIGH

7.5

Access Vector

N/A

Authentication

N/A

RAW VECTOR AV:N/AC:L/Au:N/C:P/I:P/A:P

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2006-4514 Exploits & PoCs (Proof Of Concept)

No public PoCs found in our database for this CVE.

April 23, 2026 MODIFIED

Vulnerability data updated via NVD.

April 09, 2025 MODIFIED

Vulnerability data or affected products updated.

November 30, 2006 PUBLISHED

Vulnerability first announced in NVD.

Attack Vector Matrix

Access Vector N/A

Complexity N/A

Privileges N/A

Interaction NONE

CVSS Vector String


                                    AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected Stack

No specific products linked.