Bug 826077 (CVE-2012-2665) - CVE-2012-2665 openoffice.org, libreoffice: Multiple heap-based buffer overflows in the XML manifest encryption handling code
Summary: CVE-2012-2665 openoffice.org, libreoffice: Multiple heap-based buffer overflo...
Alias: CVE-2012-2665
Product: Security Response
Classification: Other
Component: vulnerability   
(Show other bugs)
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
Whiteboard: impact=important,public=20120801,repo...
Keywords: Security
: 826095 (view as bug list)
Depends On: 839864 839866 839867 839868 845119
Blocks: 826125
TreeView+ depends on / blocked
Reported: 2012-05-29 14:30 UTC by Jan Lieskovsky
Modified: 2016-03-04 11:56 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2015-08-24 16:04:37 UTC
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
Proposed patches from Caolan McNamara for all three issues (9.14 KB, application/x-tar-gz)
2012-06-01 15:10 UTC, Jan Lieskovsky
no flags Details

External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2012:1135 normal SHIPPED_LIVE Important: libreoffice security update 2012-08-01 23:45:16 UTC
Red Hat Product Errata RHSA-2012:1136 normal SHIPPED_LIVE Important: openoffice.org security update 2012-08-01 23:33:27 UTC

Description Jan Lieskovsky 2012-05-29 14:30:28 UTC
Multiple heap-based buffer overflow flaws were found in the XML manifest encryption handling code of OpenOffice.org and LibreOffice:

1) Previously it was not checked if the particular tag was contained within expected parent tag, leading to possibility of child tag handler being able to write its data into different (than expected) parent handler sequence, leading to heap buffer overflow,

2) also a fixed size sequence was allocated to record properties of a particular XML tag, associated with XML element. By duplicating certain tags in XML manifest it was possible to write past the heap-based buffer bounds,

3) yet, the Base64 decoder implementation incorrectly assumed the length of ChecksumAttribute (input buffer) to be evenly divisible by 4, leading into the storage for output (Base64 decoded) buffer to be underallocated, resulting into heap buffer overflow.

A remote attacker could provide a specially-crafted Open Document Text (.odt) file, that when opened would cause OpenOffice.org / LibreOffice to crash or, potentially execute arbitrary code with the privileges of the user running a tool from the suite.

Comment 4 Jan Lieskovsky 2012-05-29 14:45:37 UTC
This issue affects the versions of the openoffice.org package, as shipped
with Red Hat Enterprise Linux 5 and 6.


This issue affects the versions of the libreoffice package, as shipped with Fedora release of 15 and 16.

Comment 6 Jan Lieskovsky 2012-06-01 15:10:56 UTC
Created attachment 588505 [details]
Proposed patches from Caolan McNamara for all three issues

Comment 7 Jan Lieskovsky 2012-06-01 16:07:30 UTC
The CVE identifier of CVE-2012-2665 has been assigned to this issue.

Comment 9 Jan Lieskovsky 2012-07-03 16:29:43 UTC

Upstream acknowledges Timo Warns as the original reporter of this issue.

Comment 13 Vincent Danen 2012-08-01 15:09:08 UTC
External References:


Comment 14 errata-xmlrpc 2012-08-01 19:35:58 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2012:1136 https://rhn.redhat.com/errata/RHSA-2012-1136.html

Comment 15 errata-xmlrpc 2012-08-01 19:46:24 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2012:1135 https://rhn.redhat.com/errata/RHSA-2012-1135.html

Comment 16 Vincent Danen 2012-08-01 20:26:42 UTC
Created libreoffice tracking bugs for this issue

Affects: fedora-all [bug 845119]

Comment 17 Fedora Update System 2012-08-10 22:37:02 UTC
libreoffice- has been pushed to the Fedora 16 stable repository.  If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.