Bug 431226 (CVE-2008-0668)

Summary:	CVE-2008-0668 gnumeric: integer overflow and signedness errors in XLS processing
Product:	[Other] Security Response	Reporter:	Tomas Hoger <thoger>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	hdegoede
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2008-02-26 14:04:12 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	431228, 431229
Bug Blocks:

Description Tomas Hoger 2008-02-01 16:13:37 UTC

Secunia has published an advisory regarding flaws in gnumerinc's XLS parser:

  http://secunia.com/advisories/28725/

Quoting the advisory:
  The vulnerability is caused due to integer overflows and signedness errors
  when processing XLS HLINK opcodes within the "excel_read_HLINK()" function
  in plugins/excel/ms-excel-read.c. This can be exploited to corrupt the stack
  via a specially crafted XLS file.

  Successful exploitation allows execution of arbitrary code.

  The vulnerability is confirmed in version 1.6.3. Versions prior to 1.8.1 may
  also be affected.

Described issue should be fixed in upstream version 1.8.1.

References:
http://bugzilla.gnome.org/show_bug.cgi?id=505330
http://www.gnome.org/projects/gnumeric/announcements/1.8/gnumeric-1.8.1.shtml

Patch as committed to upstream SVN:
http://svn.gnome.org/viewvc/gnumeric/trunk/plugins/excel/ms-excel-read.c?r1=16237&r2=16280

Comment 2 Fedora Update System 2008-02-04 16:09:25 UTC

gnumeric-1.6.3-14.fc8 has been submitted as an update for Fedora 8

Comment 3 Fedora Update System 2008-02-04 16:09:55 UTC

gnumeric-1.6.3-14.fc7 has been submitted as an update for Fedora 7

Comment 4 Fedora Update System 2008-02-07 20:54:40 UTC

gnumeric-1.6.3-14.fc7 has been pushed to the Fedora 7 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 5 Fedora Update System 2008-02-07 21:01:25 UTC

gnumeric-1.6.3-14.fc8 has been pushed to the Fedora 8 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 6 Tomas Hoger 2008-02-26 14:04:12 UTC

This was addressed in:

https://admin.fedoraproject.org/updates/F7/FEDORA-2008-1313
https://admin.fedoraproject.org/updates/F8/FEDORA-2008-1403