Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.
Bug 217738 - CVE-2006-6120 koffice integer overflow
CVE-2006-6120 koffice integer overflow
Product: Red Hat Enterprise Linux 2.1
Classification: Red Hat
Component: koffice (Show other bugs)
All Linux
medium Severity medium
: ---
: ---
Assigned To: Ngo Than
: Security
Depends On:
  Show dependency treegraph
Reported: 2006-11-29 13:11 EST by Josh Bressers
Modified: 2007-11-30 17:06 EST (History)
1 user (show)

See Also:
Fixed In Version: RHSA-2007-0010
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2007-02-20 11:55:38 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
Proposed patch from Kees (3.38 KB, patch)
2006-11-29 13:20 EST, Josh Bressers
no flags Details | Diff

External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2007:0010 normal SHIPPED_LIVE Moderate: koffice security update 2007-02-20 11:55:36 EST

  None (edit)
Description Josh Bressers 2006-11-29 13:11:26 EST
Kees Cook discovered an integer overflow flaw in koffice.  Here are the details
from Kees:

    While digging into a segv-during-mem-read crash reported to us, I
    discovered that it was possible to overwrite heap memory using a crafted
    PPT file.  The problem is in filters/olefilters/lib/klaola.cc (which
    I think was removed in the 1.5.x koffice tree, and put back in 1.6.x):

void KLaola::readBigBlockDepot() {
    bigBlockDepot=new unsigned char[0x200*num_of_bbd_blocks];
    for(unsigned int i=0; i<num_of_bbd_blocks; ++i)
        memcpy(&bigBlockDepot[i*0x200], &m_file.data[(bbd_list[i]+1)*0x200], 0x200);

    num_of_bbd_blocks comes directly from the file being read and can wrap
    when multiplied, reading file contents into heap memory.  I think it
    could be exploited, but it would be tricky, since you need to not write
    past the end of the heap segment when doing it.  At least on my amd64
    machine this looks to be possible, though glibc notices the problem and
    tries to shut down
Comment 2 Josh Bressers 2006-11-29 13:20:57 EST
Created attachment 142398 [details]
Proposed patch from Kees
Comment 5 Josh Bressers 2006-12-06 09:40:17 EST
This is now public
Comment 9 Red Hat Bugzilla 2007-02-20 11:55:38 EST
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.


Note You need to log in before you can comment on or make changes to this bug.