CVE-2015-0848 Heap overflow
CVE-2015-4588 RLE decoding doesn’t check that the “count” fits into the image
CVE-2015-4695 meta_pen_create heap buffer overflow
CVE-2015-4696 wmf2gd/wmf2eps use after free