Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.
First Last Prev Next    This bug is not in your last search results.
Bug 1507805 - (CVE-2017-12607) CVE-2017-12607 libreoffice: Out-of-bounds write in the PPTStyleSheet::PPTStyleSheet functionality
CVE-2017-12607 libreoffice: Out-of-bounds write in the PPTStyleSheet::PPTStyl...
Status: CLOSED WONTFIX
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
impact=moderate,public=20171026,repor...
: Security
Depends On: 1507808
Blocks: 1507560
  Show dependency tree / graph
 
Reported: 2017-10-31 04:20 EDT by Andrej Nemec
Modified: 2017-10-31 06:00 EDT (History)
6 users (show)

See Also:
Fixed In Version: libreoffice 5.0.2
Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2017-10-31 05:23:45 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

  None (edit)
Description Andrej Nemec 2017-10-31 04:20:30 EDT 
An exploitable out of bound write vulnerability exists in the PPTStyleSheet::PPTStyleSheet functionality of Apache OpenOffice. A specially crafted PPT file can cause an out of bound write resulting in arbitrary code execution. An attacker can send/provide a malicious PPT file to trigger this vulnerability.

External References:

https://www.talosintelligence.com/reports/TALOS-2017-0300
https://www.openoffice.org/security/cves/CVE-2017-12607.html
https://www.libreoffice.org/about-us/security/advisories/CVE-2017-12607
Comment 1 Andrej Nemec 2017-10-31 04:23:06 EDT 
Created libreoffice tracking bugs for this issue:

Affects: fedora-all [bug 1507808]
Comment 2 David Tardon 2017-10-31 04:52:23 EDT 
At a glance, this should be addressed by https://gerrit.libreoffice.org/gitweb?p=core.git;a=commitdiff_plain;h=6c401a7bdc4e0f5340203b9885e368cb96986aa1 . Is it possible to get a reproducer?
Comment 3 David Tardon 2017-10-31 05:08:24 EDT 
The actual commit fixing this is https://cgit.freedesktop.org/libreoffice/core/commit/?id=334dba623dfb0c4fb2b5292c2d03741b7b33aef1 -> no current Fedora is vulnerable.
Comment 4 Huzaifa S. Sidhpurwala 2017-10-31 05:23:45 EDT 
As per LibreOffice upstream advisory mentioned in comment 0, this issue is fixed in version 5.0.2, hence only the version shipped with Red Hat Enterprise Linux 6 is vulnerable.
Note You need to log in before you can comment on or make changes to this bug.
First Last Prev Next    This bug is not in your last search results.