Bug 720006 (CVE-2011-2685)

Summary:	CVE-2011-2685 libreoffice (Lotus Word Pro filter): Multiple stack buffer overflows when processing certain LWP files (VU#953183)
Product:	[Other] Security Response	Reporter:	Jan Lieskovsky <jlieskov>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	caolanm, dtardon, ltinkl
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	Upstream: LibreOffice-3.3.3, LibreOffice-3.4.0 Fedora-15: libreoffice-3.3.3.1-1.fc15	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2011-07-27 08:06:46 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	720015

Description Jan Lieskovsky 2011-07-08 16:57:30 UTC

Multiple stack based buffer overflow flaws were found in the way Lotus Word Pro (LWP) filter of the LibreOffice office productivity suite handled import of certain Lotus Word Pro documents. A remote attacker could provide a specially-crafted LWP file, which once opened by an unsuspecting user inone of the LibreOffice suite tools could lead to crash of that tool, or, potentially arbitrary code execution with the privileges of the user running the particular tool.

References:
[1] http://www.kb.cert.org/vuls/id/953183
[2] https://bugzilla.novell.com/show_bug.cgi?id=704311
[3] http://www.openwall.com/lists/oss-security/2011/07/06/13
    (CVE request)

Upstream patches:
[4] http://cgit.freedesktop.org/libreoffice/filters/commit/?id=d93fa011d713100775cd3ac88c468b6830d48877
[5] http://cgit.freedesktop.org/libreoffice/filters/commit/?id=278831e37a23e9e2e29ca811c3a5398b7c67464d

Comment 1 Jan Lieskovsky 2011-07-08 17:04:57 UTC

These issues did NOT affect the versions of the openoffice.org and openoffice.org2 packages, as shipped with Red Hat Enterprise Linux 4, since those versions do not provide Lotus Word Pro import filter support yet.

These issues did NOT affect the versions of the openoffice.org package, as shipped with Red Hat Enterprise Linux 5 and 6, since those versions do not provide Lotus Word Pro import filter support yet.

--

These issues did NOT affect the version of the openoffice.org package, as shipped with Fedora release of 14, since that version do not provide Lotus Word Pro import filter support yet.

--

These issues do NOT affect the version of the libreoffice package, as shipped with Fedora release of 15. Particular issues were addressed in the libreoffice-3.3.3.1-1.fc15 update for Fedora 15 release.

Comment 2 Jan Lieskovsky 2011-07-15 08:31:57 UTC

The CVE identifier of CVE-2011-2685 has been assigned to this issue:
http://www.openwall.com/lists/oss-security/2011/07/12/13

Comment 3 Huzaifa S. Sidhpurwala 2011-07-27 08:06:46 UTC

Statement:

Not vulnerable. This issue did not affect the versions of openoffice.org and openoffice.org2 packages as shipped with Red Hat Enterprise Linux 4, and the versions of openoffice.org packages as shipped with Red Hat Enterprise Linux 5 and 6.