Date: Thu, 1 Nov 2012 14:44:23 -0600 From: Vincent Danen <vdanen@...hat.com> To: oss-security@...ts.openwall.com Subject: CVE-2012-4233: multiple null pointer dereference flaws in LibreOffice/OpenOffice.org This one took me a bit by surprise. Debian released an advisory for OOo and I have no record of this CVE anywhere. It looks as though it went public yesterday, and was fixed in upstream 126.96.36.199, but it's not noted on the LibreOffice web site at all. Does anyone have any further details on these issues? I just filed a bug in our bugzilla (https://bugzilla.redhat.com/show_bug.cgi?id=872350) with the following description/references which are all I've been able to find so far. I'm not sure on the commit referenced as  below; that was the first one that caught my eye, but I think it might be a red herring as it doesn't seem to be relevant to any of the file types that are noted as affected. Any further information anyone has would be sincerely appreciated. It was reported  that LibreOffice suffered from multiple NULL pointer dereference flaws in at least version 188.8.131.52 and possibly earlier. These flaws are reported to be corrected in 184.108.40.206 , however I am unable to find a specific reference for this CVE on the LibreOffice site. Debian has released an advisory for OpenOffice.org  so it presumably affected as well. These flaws affect ODT files, ODG files, PPT files (when handling the PolyPolygon record within an embedded .wmf file), and XLS files. Checking the LibreOffice git, I see two commits that may be relevant ,. However there are a lot of commits to go through between now and the time that High-Tech Bridge indicates they reported the flaws upstream (July 26th, 2012).  https://www.htbridge.com/advisory/HTB23106  http://www.libreoffice.org/download/release-notes/#LO355  http://www.debian.org/security/2012/dsa-2570  http://cgit.freedesktop.org/libreoffice/core/commit/?h=libreoffice-3-5-7&id=f95762beb3b5849bfaccd39523a11fe15b191d89  http://cgit.freedesktop.org/libreoffice/core/commit/?h=libreoffice-3-5-7&id=8ca9fb05c9967f11670d045886438ddfa3ac02a7 -- Vincent Danen / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.