CVE-2012-2665: Buffer Overflow
First published: Tue May 29 2012(Updated: )
Multiple heap-based buffer overflow flaws were found in the XML manifest encryption handling code of OpenOffice.org and LibreOffice: 1) Previously it was not checked if the particular tag was contained within expected parent tag, leading to possibility of child tag handler being able to write its data into different (than expected) parent handler sequence, leading to heap buffer overflow, 2) also a fixed size sequence was allocated to record properties of a particular XML tag, associated with XML element. By duplicating certain tags in XML manifest it was possible to write past the heap-based buffer bounds, 3) yet, the Base64 decoder implementation incorrectly assumed the length of ChecksumAttribute (input buffer) to be evenly divisible by 4, leading into the storage for output (Base64 decoded) buffer to be underallocated, resulting into heap buffer overflow. A remote attacker could provide a specially-crafted Open Document Text (.odt) file, that when opened would cause OpenOffice.org / LibreOffice to crash or, potentially execute arbitrary code with the privileges of the user running a tool from the suite.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache OpenOffice | <3.4.1 | |
| Libreoffice Libreoffice | <3.5.5 | |
| Canonical Ubuntu Linux | =10.04 | |
| Canonical Ubuntu Linux | =11.04 | |
| Canonical Ubuntu Linux | =11.10 | |
| Canonical Ubuntu Linux | =12.04 | |
| Debian Debian Linux | =6.0 | |
| Debian Debian Linux | =7.0 | |
| Redhat Enterprise Linux | =6.0 | |
| Redhat Enterprise Linux Desktop | =6.0 | |
| Redhat Enterprise Linux For Ibm Z Systems | =6.0 | |
| Redhat Enterprise Linux For Power Big Endian | =6.0 | |
| Redhat Enterprise Linux Server | =6.0 | |
| Redhat Enterprise Linux Server From Rhui 6 | =6.0 | |
| Redhat Enterprise Linux Workstation | =6.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=588505
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=588505&action=edit
- https://access.redhat.com/security/cve/CVE-2012-2665
- http://www.libreoffice.org/advisories/CVE-2012-2665/
- https://rhn.redhat.com/errata/RHSA-2012-1136.html
- https://rhn.redhat.com/errata/RHSA-2012-1135.html
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=845119
- https://bugzilla.redhat.com/show_bug.cgi?id=826077
- http://rhn.redhat.com/errata/RHSA-2012-1135.html
- http://secunia.com/advisories/50142
- http://secunia.com/advisories/50146
- http://secunia.com/advisories/50692
- http://secunia.com/advisories/60799
- http://security.gentoo.org/glsa/glsa-201209-05.xml
- http://www.debian.org/security/2012/dsa-2520
- http://www.gentoo.org/security/en/glsa/glsa-201408-19.xml
- http://www.libreoffice.org/about-us/security/advisories/cve-2012-2665/
- http://www.pre-cert.de/advisories/PRE-SA-2012-05.txt
- http://www.securityfocus.com/bid/54769
- http://www.securitytracker.com/id?1027331
- http://www.securitytracker.com/id?1027332
- http://www.ubuntu.com/usn/USN-1536-1
- http://www.ubuntu.com/usn/USN-1537-1
- collector/redhat-bugzilla
- alias/CVE-2012-2665
- agent/severity
- agent/author
- agent/type
- agent/description
- agent/event
- agent/softwarecombine
- agent/last-modified-date
- agent/first-publish-date
- agent/references
- agent/weakness
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/apache
- canonical/apache openoffice
- vendor/libreoffice
- canonical/libreoffice libreoffice
- vendor/canonical
- canonical/canonical ubuntu linux
- version/canonical ubuntu linux/10.04
- version/canonical ubuntu linux/11.04
- version/canonical ubuntu linux/11.10
- version/canonical ubuntu linux/12.04
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/6.0
- version/debian debian linux/7.0
- vendor/redhat
- canonical/redhat enterprise linux
- version/redhat enterprise linux/6.0
- canonical/redhat enterprise linux desktop
- version/redhat enterprise linux desktop/6.0
- canonical/redhat enterprise linux for ibm z systems
- version/redhat enterprise linux for ibm z systems/6.0
- canonical/redhat enterprise linux for power big endian
- version/redhat enterprise linux for power big endian/6.0
- canonical/redhat enterprise linux server
- version/redhat enterprise linux server/6.0
- canonical/redhat enterprise linux server from rhui 6
- version/redhat enterprise linux server from rhui 6/6.0
- canonical/redhat enterprise linux workstation
- version/redhat enterprise linux workstation/6.0