Bug 826077 (CVE-2012-2665)

Summary: CVE-2012-2665 openoffice.org, libreoffice: Multiple heap-based buffer overflows in the XML manifest encryption handling code
Product: [Other] Security Response Reporter: Jan Lieskovsky <jlieskov>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: caolanm, mjc, mstahl, security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2015-08-24 16:04:37 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 839864, 839866, 839867, 839868, 845119    
Bug Blocks: 826125    
Description Flags
Proposed patches from Caolan McNamara for all three issues none

Description Jan Lieskovsky 2012-05-29 14:30:28 UTC
Multiple heap-based buffer overflow flaws were found in the XML manifest encryption handling code of OpenOffice.org and LibreOffice:

1) Previously it was not checked if the particular tag was contained within expected parent tag, leading to possibility of child tag handler being able to write its data into different (than expected) parent handler sequence, leading to heap buffer overflow,

2) also a fixed size sequence was allocated to record properties of a particular XML tag, associated with XML element. By duplicating certain tags in XML manifest it was possible to write past the heap-based buffer bounds,

3) yet, the Base64 decoder implementation incorrectly assumed the length of ChecksumAttribute (input buffer) to be evenly divisible by 4, leading into the storage for output (Base64 decoded) buffer to be underallocated, resulting into heap buffer overflow.

A remote attacker could provide a specially-crafted Open Document Text (.odt) file, that when opened would cause OpenOffice.org / LibreOffice to crash or, potentially execute arbitrary code with the privileges of the user running a tool from the suite.

Comment 4 Jan Lieskovsky 2012-05-29 14:45:37 UTC
This issue affects the versions of the openoffice.org package, as shipped
with Red Hat Enterprise Linux 5 and 6.


This issue affects the versions of the libreoffice package, as shipped with Fedora release of 15 and 16.

Comment 6 Jan Lieskovsky 2012-06-01 15:10:56 UTC
Created attachment 588505 [details]
Proposed patches from Caolan McNamara for all three issues

Comment 7 Jan Lieskovsky 2012-06-01 16:07:30 UTC
The CVE identifier of CVE-2012-2665 has been assigned to this issue.

Comment 9 Jan Lieskovsky 2012-07-03 16:29:43 UTC

Upstream acknowledges Timo Warns as the original reporter of this issue.

Comment 13 Vincent Danen 2012-08-01 15:09:08 UTC
External References:


Comment 14 errata-xmlrpc 2012-08-01 19:35:58 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2012:1136 https://rhn.redhat.com/errata/RHSA-2012-1136.html

Comment 15 errata-xmlrpc 2012-08-01 19:46:24 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2012:1135 https://rhn.redhat.com/errata/RHSA-2012-1135.html

Comment 16 Vincent Danen 2012-08-01 20:26:42 UTC
Created libreoffice tracking bugs for this issue

Affects: fedora-all [bug 845119]

Comment 17 Fedora Update System 2012-08-10 22:37:02 UTC
libreoffice- has been pushed to the Fedora 16 stable repository.  If problems still persist, please make note of it in this bug report.