Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 2 Nov 2012 09:07:31 +0100
From: Marcus Meissner <meissner@...e.de>
To: oss-security@...ts.openwall.com, caolanm@...hat.com
Subject: Re: CVE-2012-4233: multiple null pointer
	dereference flaws in LibreOffice/OpenOffice.org

On Thu, Nov 01, 2012 at 02:44:23PM -0600, Vincent Danen wrote:
> This one took me a bit by surprise.  Debian released an advisory for OOo
> and I have no record of this CVE anywhere.  It looks as though it went
> public yesterday, and was fixed in upstream 3.5.7.2, but it's not noted
> on the LibreOffice web site at all.
>
> Does anyone have any further details on these issues?  I just filed a
> bug in our bugzilla (https://bugzilla.redhat.com/show_bug.cgi?id=872350)
> with the following description/references which are all I've been able
> to find so far.
>
> I'm not sure on the commit referenced as [4] below; that was the first
> one that caught my eye, but I think it might be a red herring as it
> doesn't seem to be relevant to any of the file types that are noted as
> affected.
>
> Any further information anyone has would be sincerely appreciated.


I am not sure I am allowed to forward the quoted tdf-security mail
that lists the LibreOffice commits.

But it has in its mailheader:
From:     Caolán McNamara <caolanm@...hat.com>
perhaps he can share the details (and I wonder why this caught redhat
by surprise then);

(The whole OpenOffice/LibreOffice security issue handling is not really
good ... long embargoes that get extended wildly even though fixes are in
public GIT already, etc )

Ciao, Marcus

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.