Bug 222808 (CVE-2007-0002)

Summary: CVE-2007-0002 buffer overflows
Product: [Other] Security Response Reporter: Mark J. Cox <mjc>
Component: vulnerabilityAssignee: Caolan McNamara <caolanm>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: RHSA-2007-0055 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2007-03-16 14:18:26 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
EMBARGOED proposed patch against 0.8.8
none
updated patch against the wpd we're shipping in RHEL-5 none

Description Mark J. Cox 2007-01-16 09:56:04 UTC 
iDefense discovered a TablesGroup Heap Overflow Vulnerability in libwpd.  We're
waiting on the full details but it's likely that an attacker could create a
malicious WordPerfect file that could execute arbitrary code if opened by a
victim in an application using libwpd such as OpenOffice.

No date on embargo; not sure if this will make it before GA or need a 0day.
Comment 1 Mark J. Cox 2007-01-16 09:56:04 UTC 
Created attachment 145665 [details]
EMBARGOED proposed patch against 0.8.8
Comment 2 Caolan McNamara 2007-01-16 11:54:25 UTC 
Created attachment 145676 [details]
updated patch against the wpd we're shipping in RHEL-5
Comment 3 Mark J. Cox 2007-01-18 09:40:59 UTC 
This will need a 0day, won't make GA
Comment 4 Paul Gampe 2007-02-01 19:00:28 UTC 
Approving for CVS commit.
Comment 5 Caolan McNamara 2007-02-01 20:44:36 UTC 
RHEL-5:libwpd-0.8.7-2.el5
Comment 11 Mark J. Cox 2007-03-16 14:13:32 UTC 
removing embargo, now public http://libwpd.sourceforge.net/news.html
Comment 12 Red Hat Bugzilla 2007-03-16 14:18:26 UTC 
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2007-0055.html