Red Hat Bugzilla – Bug 223801
CVE-2007-1466 integer overflow
Last modified: 2007-11-30 17:07:28 EST
The version of libwpd in openoffice.org in RHEL4, RHEL3 is affected by the WP6
+++ This bug was initially created as a clone of Bug #222808 +++
iDefense discovered a TablesGroup Heap Overflow Vulnerability in libwpd. We're
waiting on the full details but it's likely that an attacker could create a
malicious WordPerfect file that could execute arbitrary code if opened by a
victim in an application using libwpd such as OpenOffice.
No date on embargo
-- Additional comment from firstname.lastname@example.org on 2007-01-16 04:56 EST --
Created an attachment (id=145665)
EMBARGOED proposed patch against 0.8.8
As well as the libwpd in the old 1.1.X for RHEL-4, there's also a libwpd/RHEL-4
dir, did we ship this standalone libwpd for RHEL-4 as well ?
embargo was moved to March 6th
removing embargo, now public http://libwpd.sourceforge.net/news.html
WP6GeneralTextPacket::_readContents() think has another CVE number: CVE-2007-1466
Yes, so our open office packages in RHEL3 and RHEL4 only have the flaw in
WP6GeneralTextPacket::_readContents() (CVE-2007-1466) and not the other flaws in
CVE-2007-0002. Therefore changing the CVE name to CVE-2007-1466 and removing
CVE-2007-0002 which doesn't apply to those platforms.
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.