First published: Sun Jun 17 2012(Updated: )
Redland Raptor (aka libraptor) before 2.0.7, as used by OpenOffice 3.3 and 3.4 Beta, LibreOffice before 3.4.6 and 3.5.x before 3.5.1, and other products, allows user-assisted remote attackers to read arbitrary files via a crafted XML external entity (XXE) declaration and reference in an RDF document.
Credit: secalert@redhat.com
Affected Software | Affected Version | How to fix |
---|---|---|
apache openoffice.org | =3.3 | |
apache openoffice.org | =3.4-beta | |
Redland Raptor | <=2.0.6 | |
The Document Foundation LibreOffice | =3.3.0 | |
The Document Foundation LibreOffice | =3.3.1 | |
The Document Foundation LibreOffice | =3.3.2 | |
The Document Foundation LibreOffice | =3.3.3 | |
The Document Foundation LibreOffice | =3.3.4 | |
The Document Foundation LibreOffice | =3.4.0 | |
The Document Foundation LibreOffice | =3.4.1 | |
The Document Foundation LibreOffice | =3.4.2 | |
The Document Foundation LibreOffice | =3.4.5 | |
The Document Foundation LibreOffice | =3.5 | |
Redland Libraptor | <2.0.7 | |
The Document Foundation LibreOffice | <3.4.6 | |
The Document Foundation LibreOffice | =3.5.0 | |
Apache OpenOffice | =3.3.0 | |
Apache OpenOffice | =3.4.0-beta | |
Fedoraproject Fedora | =16 | |
Fedoraproject Fedora | =17 | |
Red Hat Gluster Storage Server | =2.0 | |
Red Hat Storage | =2.0 | |
redhat Storage for public cloud | =2.0 | |
redhat enterprise Linux desktop | =5.0 | |
redhat enterprise Linux desktop | =6.0 | |
redhat enterprise Linux eus | =6.2 | |
redhat enterprise Linux server | =5.0 | |
redhat enterprise Linux server | =6.0 | |
redhat enterprise Linux server aus | =6.2 | |
redhat enterprise Linux workstation | =5.0 | |
redhat enterprise Linux workstation | =6.0 | |
Debian GNU/Linux | =6.0 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2012-0037 has been classified as a medium severity vulnerability.
To mitigate CVE-2012-0037, you should upgrade to a fixed version of the affected software, specifically to libraptor version 2.0.7 or later, or LibreOffice version 3.4.6 or later.
CVE-2012-0037 affects several versions of OpenOffice, LibreOffice, and Redland Raptor software.
CVE-2012-0037 allows user-assisted remote attackers to read arbitrary files through a crafted XML external entity declaration.
Yes, CVE-2012-0037 involves XML external entity (XXE) vulnerabilities, which can lead to information disclosure.