{"schemaVersion":3,"id":"CVE-2006-4514","aliases":["RHSA-2007:0011","DEBIAN-CVE-2006-4514","DSA-1221-1"],"status":"published","duplicateOf":null,"title":null,"description":"Heap-based buffer overflow in the ole_info_read_metabat function in Gnome Structured File library (libgsf) 1.14.0, and other versions before 1.14.2, allows context-dependent attackers to execute arbitrary code via a large num_metabat value in an OLE document, which causes the ole_init_info function to allocate insufficient memory.","dates":{"published":"2006-11-30T23:00:00.000Z","modified":"2024-08-07T19:14:47.478Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7.5,"severity":"high","version":"2.0","versionLabel":"v2.0","source":"NVD","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","computed":false,"selection":"backend-summary"},"metrics":[{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":7.5,"severity":"high","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.04172,"percentile":0.90789,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.04172},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.04172,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.04172,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.04172,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.04172,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.04172,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.04172,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.04172,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.04172,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.04172,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.04172,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.04172,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.04172,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.04172,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.04172,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.04172,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.04172,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.04172,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.04172,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.04172,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.04172,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.04172,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.04172,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.04172,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.04172,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.04172,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.04172,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.04172,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.04172,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.04172,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.04172,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.04172,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.04172,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.04172,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.04172,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.04172,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.04172,"percentile":0.90789}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.04172,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.04172,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.04172,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.04172,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.04172,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.04172,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.04172,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.04172,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.04172,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.04172,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.04172,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.04172,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.04172,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.04172,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.04172,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.04172,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.04172,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.04172,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.04172,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.04172,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.04172,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.04172,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.04172,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.04172,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.04172,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.04172,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.04172,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.04172,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.04172,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.04172,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.04172,"percentile":0.90789}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-119","name":"Improper Restriction of Operations within the Bounds of a Memory Buffer","description":"The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.","type":"weakness","status":"Stable","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/119.html"}],"affected":[{"vendor":"debian","product":"libgsf","name":"libgsf","label":"libgsf","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/libgsf","purlType":"deb","versions":[{"text":"< 1.14.2-1","noFixRecorded":false,"fixedIn":null},{"text":"< 1.11.1-1sarge1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.14.2-1 | < 1.11.1-1sarge1","eol":null,"hubHref":null},{"vendor":"libgsf","product":"libgsf","name":"libgsf","label":"libgsf","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"1.11.1","noFixRecorded":false,"fixedIn":null},{"text":"1.13.2","noFixRecorded":false,"fixedIn":null},{"text":"1.14","noFixRecorded":false,"fixedIn":null},{"text":"1.14.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"1.11.1 | 1.13.2 | 1.14 | 1.14.1","eol":null,"hubHref":"/vendor/libgsf/libgsf"},{"vendor":"redhat","product":"libgsf","name":"libgsf","label":"libgsf","ecosystem":"Red Hat","cpePart":null,"purl":"pkg:rpm/redhat/libgsf","purlType":"rpm","versions":[{"text":"< 0:1.6.0-7","noFixRecorded":false,"fixedIn":null},{"text":"< 0:1.10.1-2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0:1.6.0-7 | < 0:1.10.1-2","eol":null,"hubHref":null},{"vendor":"redhat","product":"libgsf-debuginfo","name":"libgsf-debuginfo","label":"libgsf-debuginfo","ecosystem":"Red Hat","cpePart":null,"purl":"pkg:rpm/redhat/libgsf-debuginfo","purlType":"rpm","versions":[{"text":"< 0:1.6.0-7","noFixRecorded":false,"fixedIn":null},{"text":"< 0:1.10.1-2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0:1.6.0-7 | < 0:1.10.1-2","eol":null,"hubHref":null},{"vendor":"redhat","product":"libgsf-devel","name":"libgsf-devel","label":"libgsf-devel","ecosystem":"Red Hat","cpePart":null,"purl":"pkg:rpm/redhat/libgsf-devel","purlType":"rpm","versions":[{"text":"< 0:1.6.0-7","noFixRecorded":false,"fixedIn":null},{"text":"< 0:1.10.1-2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0:1.6.0-7 | < 0:1.10.1-2","eol":null,"hubHref":null}],"affectedCount":5,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://issues.rpath.com/browse/RPL-857","label":"issues.rpath.com/browse/RPL-857","hostname":"issues.rpath.com","tags":["X Refsource CONFIRM"]},{"url":"http://rhn.redhat.com/errata/RHSA-2007-0011.html","label":"rhn.redhat.com/errata/RHSA-2007-0011.html","hostname":"rhn.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"http://secunia.com/advisories/23167","label":"secunia.com/advisories/23167","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Vendor Advisory"]},{"url":"http://secunia.com/advisories/23920","label":"secunia.com/advisories/23920","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Vendor Advisory"]},{"url":"http://secunia.com/advisories/23352","label":"secunia.com/advisories/23352","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Vendor Advisory"]},{"url":"http://security.gentoo.org/glsa/glsa-200612-13.xml","label":"security.gentoo.org/glsa/glsa-200612-13.xml","hostname":"security.gentoo.org","tags":["Vendor Advisory","X Refsource GENTOO"]},{"url":"http://www.ubuntu.com/usn/usn-391-1","label":"www.ubuntu.com/usn/usn-391-1","hostname":"www.ubuntu.com","tags":["Vendor Advisory","X Refsource UBUNTU"]},{"url":"http://secunia.com/advisories/23227","label":"secunia.com/advisories/23227","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/21358","label":"www.securityfocus.com/bid/21358","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Patch"]},{"url":"http://www.mandriva.com/security/advisories?name=MDKSA-2006:220","label":"www.mandriva.com/security/advisories?name=MDKSA-2006:220","hostname":"www.mandriva.com","tags":["Vendor Advisory","X Refsource MANDRIVA"]},{"url":"http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=446","label":"labs.idefense.com/intelligence/vulnerabilities/display.php?id=446","hostname":"labs.idefense.com","tags":["Third Party Advisory","X Refsource IDEFENSE","Vendor Advisory"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/30611","label":"exchange.xforce.ibmcloud.com/vulnerabilities/30611","hostname":"exchange.xforce.ibmcloud.com","tags":["VDB Entry","X Refsource XF"]},{"url":"http://www.vupen.com/english/advisories/2006/4784","label":"www.vupen.com/english/advisories/2006/4784","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN","Vendor Advisory"]},{"url":"http://lists.suse.com/archive/suse-security-announce/2006-Dec/0005.html","label":"lists.suse.com/archive/suse-security-announce/2006-Dec/0005.html","hostname":"lists.suse.com","tags":["Vendor Advisory","X Refsource SUSE"]},{"url":"http://www.securityfocus.com/archive/1/454389/30/9210/threaded","label":"www.securityfocus.com/archive/1/454389/30/9210/threaded","hostname":"www.securityfocus.com","tags":["Mailing List","X Refsource BUGTRAQ"]},{"url":"http://secunia.com/advisories/23166","label":"secunia.com/advisories/23166","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Vendor Advisory"]},{"url":"http://secunia.com/advisories/23337","label":"secunia.com/advisories/23337","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Vendor Advisory"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9413","label":"oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9413","hostname":"oval.cisecurity.org","tags":["VDB Entry","Signature","X Refsource OVAL"]},{"url":"http://secunia.com/advisories/23355","label":"secunia.com/advisories/23355","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Vendor Advisory"]},{"url":"http://www.debian.org/security/2006/dsa-1221","label":"www.debian.org/security/2006/dsa-1221","hostname":"www.debian.org","tags":["Vendor Advisory","X Refsource DEBIAN","Patch"]},{"url":"http://secunia.com/advisories/23164","label":"secunia.com/advisories/23164","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Vendor Advisory"]},{"url":"http://secunia.com/advisories/23686","label":"secunia.com/advisories/23686","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Vendor Advisory"]},{"url":"http://www.xerox.com/download/security/security-bulletin/16287-4d6b7b0c81f7b/cert_XRX13-003_v1.0.pdf","label":"www.xerox.com/download/security/security-bulletin/16287-4d6b7b0c81f7b/cert_XRX13-003_v1.0.pdf","hostname":"www.xerox.com","tags":["X Refsource CONFIRM"]},{"url":"https://access.redhat.com/errata/RHSA-2007:0011","label":"access.redhat.com/errata/RHSA-2007:0011","hostname":"access.redhat.com","tags":["Advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","label":"access.redhat.com/security/updates/classification/","hostname":"access.redhat.com","tags":["ARTICLE"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=217949","label":"bugzilla.redhat.com/show_bug.cgi?id=217949","hostname":"bugzilla.redhat.com","tags":["REPORT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2007/rhsa-2007_0011.json","label":"security.access.redhat.com/data/csaf/v2/advisories/2007/rhsa-2007_0011.json","hostname":"security.access.redhat.com","tags":["Advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2006-4514","label":"access.redhat.com/security/cve/CVE-2006-4514","hostname":"access.redhat.com","tags":["REPORT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1618189","label":"bugzilla.redhat.com/show_bug.cgi?id=1618189","hostname":"bugzilla.redhat.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2006-4514","label":"www.cve.org/CVERecord?id=CVE-2006-4514","hostname":"www.cve.org","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2006-4514","label":"nvd.nist.gov/vuln/detail/CVE-2006-4514","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2006-4514","label":"security-tracker.debian.org/tracker/CVE-2006-4514","hostname":"security-tracker.debian.org","tags":["Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2006-11-30T23:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-07T19:14:47.478Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":31,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T06:06:13.315Z","stale":false,"partial":false}}