Red Hat Bugzilla – Bug 725668
CVE-2011-2713 openoffice.org: Out-of-bounds read in DOC sprm parser
Last modified: 2016-03-04 05:42:15 EST
A heap-based buffer out-ouf-bounds read was found in the way OpenOffice.org imported certain Microsoft Word Binary File Format (.DOC) file.If a user opened a specially-crafted DOC file in OpenOffice.org suite tool (oowriter), it could lead to denial of service (oowriter executable crash), or possibly, execute arbitrary code with the privileges of the user running OpenOffice.org Writer.
This has been assigned CVE-2011-2713.
Created attachment 515212 [details]
Created attachment 515213 [details]
Created attachment 515214 [details]
Created attachment 515215 [details]
Created attachment 515216 [details]
Created attachment 523579 [details]
combined backport to OpenOffice.org 3.2.1
This is public via:
It initially appeared that this flaw may be exploitable similar to CVE-2010-3452, where an OOB Read caused Arbitrary Code Execution. However in the case of this particular flaw, the junk data read is just parsed into an internal representation of properties and the maximum harm this should cause in application crash (Denial Of Service).
- Reported to firstname.lastname@example.org on 25-July-2011
- Recieved a reply (with email@example.com copied) on the same date
- Release date changed with a few delays in between
- Release on 5-Oct-2011
This issue results in an OOB read which is not exploitable for arbitrary code execution and can simply cause a crash. We do not consider this as a security issue.
This issue was discovered by Huzaifa Sidhpurwala of the Red Hat Security Response Team.