Bug 223801

Summary:	CVE-2007-1466 integer overflow
Product:	Red Hat Enterprise Linux 4	Reporter:	Mark J. Cox <mjc>
Component:	openoffice.org	Assignee:	Caolan McNamara <caolanm>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	4.0	CC:	dkovalsk, security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:	impact=important,source=vendorsec,reported=20070115,public=20070316
Fixed In Version:	RHSA-2007-0033	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2007-03-22 10:39:52 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Mark J. Cox 2007-01-22 15:43:58 UTC

The version of libwpd in openoffice.org in RHEL4, RHEL3 is affected by the WP6
issue only.

+++ This bug was initially created as a clone of Bug #222808 +++

iDefense discovered a TablesGroup Heap Overflow Vulnerability in libwpd.  We're
waiting on the full details but it's likely that an attacker could create a
malicious WordPerfect file that could execute arbitrary code if opened by a
victim in an application using libwpd such as OpenOffice.

No date on embargo

-- Additional comment from mjc on 2007-01-16 04:56 EST --
Created an attachment (id=145665)
EMBARGOED proposed patch against 0.8.8

Comment 1 Caolan McNamara 2007-01-22 15:51:15 UTC

As well as the libwpd in the old 1.1.X for RHEL-4, there's also a libwpd/RHEL-4
dir, did we ship this standalone libwpd for RHEL-4 as well ?

Comment 9 Mark J. Cox 2007-02-21 10:40:16 UTC

embargo was moved to March 6th

Comment 10 Mark J. Cox 2007-03-16 14:14:21 UTC

removing embargo, now public http://libwpd.sourceforge.net/news.html

Comment 11 Lubomir Kundrak 2007-03-20 19:06:02 UTC

WP6GeneralTextPacket::_readContents() think has another CVE number: CVE-2007-1466

Comment 12 Mark J. Cox 2007-03-20 21:05:39 UTC

Yes, so our open office packages in RHEL3 and RHEL4 only have the flaw in 
WP6GeneralTextPacket::_readContents() (CVE-2007-1466) and not the other flaws in
CVE-2007-0002.  Therefore changing the CVE name to CVE-2007-1466 and removing
CVE-2007-0002 which doesn't apply to those platforms.

Comment 13 Red Hat Bugzilla 2007-03-22 10:39:53 UTC

An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2007-0033.html