Stack-based buffer overflow in the Lotus Word Pro import filter in LibreOffice before 3.3.3 allows remote attackers to execute arbitrary code via a crafted .lwp file.

LibreOffice 3.4 includes new interesting features and fixes, see http://www.libreoffice.org/download/3-4-new-features-and-fix es/

The update fixes the following security issue :

  - 704311: libreoffice Lotus Word Pro filter multiple     vulnerabilities (CVE-2011-2685)

  - 722075: LibreOffice: Out-of-bounds read in DOC sprm     (CVE-2011-2713)

This update also fixes the following non-security issues :

  - 647959: LibO has a regression problem to show emf charts     properly.

  - 650049: pptx presentation has text in boxes and circles.
    Only text is displayed.

  - 651250: Video and Audio does not play in slide show mode     of LibO Impress.

  - 652562: LibreOffice crashes on start on 11.4-MS3 NET/DVD     install

  - 653662: libreoffice build calls mkbundle2 (deprecated)     instead of mkbundle

  - 663622: Writer crash during document save

  - 665112: could not type or edit office document

  - 675868: eliminate wording of ooconvert existed in     loconvert --help

  - 675961: Libreoffice Copy paste of formula in Writer     tables does not work as expected

  - 676858: Document with full page graphic in header will     not allow click-drag or right-click.

  - 678998: Libre Office 3.3.1 does not detect KDE3

  - 680272: Deleting multiple sheets results in run-time     error/crash

  - 681738: DDE link is lost when .xls file is opened/saved     in Calc.

  - 683578: Large xlsx file takes extremely long to open     with Libreoffice calc

  - 684784: Microsoft Office spreadsheet does not display     anything

  - 693238: Column format in docx file is not displayed     correctly.

  - 693477: Format of Word .doc file from HP is bad.

  - 694119: Using File-->Send-->Document as E-mail will     crash Impress

  - 694344: 3rd level bulleted items are not displayed     properly.

  - 695479: L3: RTF file is not displayed correctly by     Writer.

  - 696630: DDE link from Calc to Excel needs Excel open to     update link in Calc.

  - 702506: Writer crashes when opening docx files.

  - 704639: HTML document appearance changes when opened in     open office vs LibreOffice

  - 704642: 16 digit numbers change in LibreOffice when     opening a file created in MS Excel

  - 705949: Information missing from MS Word document when     opened in LibreOffice (w:sdt)

  - 706792: PTF 3.3.1-21 introduced a crash when opening a     pptx presentation.

  - 707486: Macro from excel fails on Selection.Copy when     run in Calc.

  - 707779: Disappearing text

  - 708137: xls spreadsheet is extremely slow to open and     check boxes are broken.

  - 708518: Bullet symbol is not rendered correctly in a     specific slide.

  - 710061: ODP export to PDF produces broken images

  - 710920: RPM installation ending with redundant error.

  - 711977: File association for fod* files are missing.

  - 712358: Some extensions broken after upgrading.

  - 715268: Command libreoffice --help does not work when     LibreOffice is already started

  - 715856: LibreOffice:Stable/libreoffice-converter: Bug

  - 715416: Impress crashes starting Slide show in the     context of dual monitors extension mode.

  - 715931: failed to save an odp file.

  - 717262: libtool adds /usr/lib64 into rpath

Multiple vulnerabilies has been discovered and corrected in libreoffice :

Stack-based buffer overflow in the Lotus Word Pro import filter in LibreOffice before 3.3.3 allows remote attackers to execute arbitrary code via a crafted .lwp file (CVE-2011-2685).

oowriter in OpenOffice.org 3.3.0 and LibreOffice before 3.4.3 allows user-assisted remote attackers to cause a denial of service (crash) via a crafted DOC file that triggers an out-of-bounds read in the DOC sprm parser (CVE-2011-2713).

This update brings a new LibreOffice version 3.4.3 release linked against stdc++ and gcc_s standard libraries available in the Mandriva 2011 and solves installing conflicts with libstdc++ (#64224).

The package clipart-openclipart was dropped from the main repository in the Mandriva 2011. However it is not required having clipart-openclipart installed in order to install libreoffice-openclipart as the LibreOffice still provides some cliparts directly in that package (#63634).

This update fixes some OpenOffice.org leftovers in some packages description replacing that by LibreOffice (#64658).

This update brings new LibreOffice l10n locale packages: Assanese as, Bengali bn, Dzongkha dz, Farsi fa, Irish ga, Galician gl, Gujarati gu, Croatian hr, Kannada kn, Lithuanian lt, Latvian lv, Maithili mai, Malayalam ml, Marathi mr, Ndebele nr, Northern Shoto nso, Oriya or, Punjabi pa_IN, Romanian ro, Secwepemctsin sh, Sinhalese si, Serbian sr, Swati ss, Shoto st, Telugu te, Thai th, Tswana tn, Tsonga ts, Ukrainian uk, Venda ve and Xhosa xh. Help packages are also provided for: bn, dz, gl, gu, hr, si and uk.

Additionally the gaupol packages are being provided to solve a build dependcy of some of the supporting tools already added into 2011.

The updated packages have been upgraded to LibreOffice version 3.4.3 where these isssues has been resolved.

A stack-based buffer overflow was discovered in the Lotus Word Pro import filter in OpenOffice.org. The default compiler options for affected releases should reduce the vulnerability to a denial of service. (CVE-2011-2685)

Huzaifa Sidhpurwala discovered that OpenOffice.org could be made to crash if it opened a specially crafted Word document. (CVE-2011-2713)

Integer overflows were discovered in the graphics loading code of several different image types. If a user were tricked into opening a specially crafted file, an attacker could cause OpenOffice.org to crash or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2012-1149)

Sven Jacobi discovered an integer overflow when processing Escher graphics records. If a user were tricked into opening a specially crafted PowerPoint file, an attacker could cause OpenOffice.org to crash or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2012-2334).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

LibreOffice 3.4 includes many interesting features and fixes, see http://www.libreoffice.org/download/3-4-new-features-and-fixes/

The update fixes the following security issues :

  - 704311: libreoffice Lotus Word Pro filter multiple     vulnerabilities. (CVE-2011-2685)

This update also fixes the following non-security issues :

  - 676858: Document with full page graphic in header will     not allow click-drag or right-click.

  - 681738: DDE link is lost when .xls file is opened/saved     in Calc.

  - 683578: Large xlsx file takes extremely long to open     with Libreoffice calc

  - 684784: Microsoft Office spreadsheet does not display     anything

  - 693238: Column format in docx file is not displayed     correctly.

  - 693477: Format of Word .doc file from HP is bad.

  - 694344: 3rd level bulleted items are not displayed     properly.

  - 695479: L3: RTF file is not displayed correctly by     Writer.

  - 696630: DDE link from Calc to Excel needs Excel open to     update link in Calc.

  - 702506: Writer crashes when opening docx files.

  - 704639: HTML document appearance changes when opened in     open office vs LibreOffice

  - 704642: 16 digit numbers change in LibreOffice when     opening a file created in MS Excel

  - 705949: Information missing from MS Word document when     opened in LibreOffice (w:sdt)

  - 706792: PTF 3.3.1-21 introduced a crash when opening a     pptx presentation.

  - 707486: Macro from excel fails on Selection.Copy when     run in Calc.

  - 707779: Disappearing text

  - 708137: xls spreadsheet is extremely slow to open and     check boxes are broken.

  - 708518: Bullet symbol is not rendered correctly in a     specific slide.

  - 710061: ODP export to PDF produces broken images

  - 710920: RPM installation ending with redundant error.

  - 711977: File association for fod* files are missing.

  - 712358: Some extensions broken after upgrading.

  - 715268: Command libreoffice --help does not work when     LibreOffice is already started

  - 715416: Impress crashes starting Slide show in the     context of dual monitors extension mode.

  - 715931: failed to save an odp file.

LibreOffice 3.4 includes new interesting features and fixes, see http://www.libreoffice.org/download/3-4-new-features-and-fixes/

The update fixes the following security issue :

  - 704311: libreoffice Lotus Word Pro filter multiple     vulnerabilities. (CVE-2011-2685)

  - 722075: LibreOffice: Out-of-bounds read in DOC sprm     (CVE-2011-2713) This update also fixes the following     non-security issues :

  - 653519: Welcome screen missing.

  - 653662: libreoffice build calls mkbundle2 (deprecated)     instead of mkbundle

  - 663622: Writer crash during document save

  - 675868: eliminate wording of ooconvert existed in     loconvert --help

  - 675961: Libreoffice Copy paste of formula in Writer     tables does not work as expected

  - 676858: Document with full page graphic in header will     not allow click-drag or right-click.

  - 677354: The languagetool.rpm does not work as expected

  - 678998: Libre Office does not detect KDE3

  - 680272: Deleting multiple sheets results in run-time     error/crash

  - 681738: DDE link is lost when .xls file is opened/saved     in Calc.

  - 683578: Large xlsx file takes extremely long to open     with Libreoffice calc

  - 684784: Microsoft Office spreadsheet does not display     anything

  - 693238: Column format in docx file is not displayed     correctly.

  - 693477: Format of Word .doc file from HP is bad.

  - 694119: Using File-->Send-->Document as E-mail will     crash Impress

  - 694344: 3rd level bulleted items are not displayed     properly.

  - 695479: RTF file is not displayed correctly by Writer.

  - 696630: DDE link from Calc to Excel needs Excel open to     update link in Calc.

  - 699334: Presentation created in MS Office is missing     text when opened in LibreOffice

  - 701317: xls spreadsheet macro fails with LibreOffice.

  - 702506: Writer crashes when opening docx files.

  - 704639: HTML document appearance changes when opened in     open office vs LibreOffice

  - 704642: 16 digit numbers change in LibreOffice when     opening a file created in MS Excel

  - 705949: Information missing from MS Word document when     opened in LibreOffice (w:sdt)

  - 706792: crash when opening a pptx presentation.

  - 707486: Macro from excel fails on Selection.Copy when     run in Calc.

  - 707779: Disappearing text

  - 708137: xls spreadsheet is extremely slow to open and     check boxes are broken.

  - 708518: Bullet symbol is not rendered correctly in a     specific slide.

  - 710061: ODP export to PDF produces broken images

  - 710920: RPM installation ending with redundant error.

  - 711977: File association for fod* files are missing.

  - 712358: Some extensions broken after upgrading.

  - 715268: Command libreoffice --help does not work when     LibreOffice is already started

  - 715416: Impress crashes starting Slide show in the     context of dual monitors extension mode.

  - 715931: failed to save an odp file.

  - 717262: libtool adds /usr/lib64 into rpath

  - 715856: LibreOffice:Stable/libreoffice-converter: Bug

  - 677354: The languagetool.rpm does not work as expected.

  - 693200: Documents created in MS Office cause LibreOffice     to crash

  - 693386: Documents created in MS Office bring up the     filter selection dialog when opened with LibreOffice

  - 693427: When using QT dialogs and not LibreOffice     dialogs causes LibreOffice to hang when attempting to     save a document

  - 706731: VBA Macros from MS Office Spreadsheet do not     work correct with LibreOffice 3.3.1

The version of LibreOffice installed on the remote Mac OS X host is earlier than 3.3.3 / 3.4.0.  As such, it is reportedly affected by a stack buffer overflow in the Lotus Word Pro import filter that arises from its failure to properly handle object ids in '.lwp' documents. 

If an attacker can trick a user on the affected system into importing a specially crafted .lwp document into the application, he could leverage this issue to execute arbitrary code subject to the user's privileges.

The version of LibreOffice installed on the remote host is earlier than 3.3.3 / 3.4.0.  As such, it is reportedly affected by a stack buffer overflow in the Lotus Word Pro import filter that arises from its failure to properly handle object ids in '.lwp' documents. 

If an attacker can trick a user on the affected system into importing a specially crafted .lwp document into the application, he could leverage this issue to execute arbitrary code subject to the user's privileges.

ID	Name	Product	Family	Severity
75919	openSUSE Security Update : libreoffice-34 (openSUSE-SU-2011:1143-2)	Nessus	SuSE Local Security Checks	high
75611	openSUSE Security Update : libreoffice-34 (openSUSE-SU-2011:1143-1)	Nessus	SuSE Local Security Checks	high
61936	Mandriva Linux Security Advisory : libreoffice (MDVSA-2011:172)	Nessus	Mandriva Local Security Checks	high
59833	Ubuntu 10.04 LTS : openoffice.org vulnerabilities (USN-1496-1)	Nessus	Ubuntu Local Security Checks	high
57219	SuSE 10 Security Update : libreoffice (ZYPP Patch Number 7791)	Nessus	SuSE Local Security Checks	high
57118	SuSE 11.1 Security Update : LibreOffice (SAT Patch Number 5271)	Nessus	SuSE Local Security Checks	high
55576	LibreOffice < 3.3.3 / 3.4.0 LWP File Handling Overflow (Mac OS X)	Nessus	MacOS X Local Security Checks	high
55574	LibreOffice < 3.3.3 / 3.4.0 LWP File Handling Overflow	Nessus	Windows	high

Detections

Analytics

CVE-2011-2685

high

Tenable Plugins

high

high

high

high

high

high

high

high