oowriter in OpenOffice.org 3.3.0 and LibreOffice before 3.4.3 allows user-assisted remote attackers to cause a denial of service (crash) via a crafted DOC file that triggers an out-of-bounds read in the DOC sprm parser.

The remote host is affected by the vulnerability described in GLSA-201408-19 (OpenOffice, LibreOffice: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in OpenOffice and       Libreoffice. Please review the CVE identifiers referenced below for       details.
  Impact :

    A remote attacker could entice a user to open a specially crafted file       using OpenOffice, possibly resulting in execution of arbitrary code with       the privileges of the process, a Denial of Service condition, execution       of arbitrary Python code, authentication bypass, or reading and writing       of arbitrary files.
  Workaround :

    There is no known workaround at this time.

LibreOffice 3.4 includes new interesting features and fixes, see http://www.libreoffice.org/download/3-4-new-features-and-fix es/

The update fixes the following security issue :

  - 704311: libreoffice Lotus Word Pro filter multiple     vulnerabilities (CVE-2011-2685)

  - 722075: LibreOffice: Out-of-bounds read in DOC sprm     (CVE-2011-2713)

This update also fixes the following non-security issues :

  - 647959: LibO has a regression problem to show emf charts     properly.

  - 650049: pptx presentation has text in boxes and circles.
    Only text is displayed.

  - 651250: Video and Audio does not play in slide show mode     of LibO Impress.

  - 652562: LibreOffice crashes on start on 11.4-MS3 NET/DVD     install

  - 653662: libreoffice build calls mkbundle2 (deprecated)     instead of mkbundle

  - 663622: Writer crash during document save

  - 665112: could not type or edit office document

  - 675868: eliminate wording of ooconvert existed in     loconvert --help

  - 675961: Libreoffice Copy paste of formula in Writer     tables does not work as expected

  - 676858: Document with full page graphic in header will     not allow click-drag or right-click.

  - 678998: Libre Office 3.3.1 does not detect KDE3

  - 680272: Deleting multiple sheets results in run-time     error/crash

  - 681738: DDE link is lost when .xls file is opened/saved     in Calc.

  - 683578: Large xlsx file takes extremely long to open     with Libreoffice calc

  - 684784: Microsoft Office spreadsheet does not display     anything

  - 693238: Column format in docx file is not displayed     correctly.

  - 693477: Format of Word .doc file from HP is bad.

  - 694119: Using File-->Send-->Document as E-mail will     crash Impress

  - 694344: 3rd level bulleted items are not displayed     properly.

  - 695479: L3: RTF file is not displayed correctly by     Writer.

  - 696630: DDE link from Calc to Excel needs Excel open to     update link in Calc.

  - 702506: Writer crashes when opening docx files.

  - 704639: HTML document appearance changes when opened in     open office vs LibreOffice

  - 704642: 16 digit numbers change in LibreOffice when     opening a file created in MS Excel

  - 705949: Information missing from MS Word document when     opened in LibreOffice (w:sdt)

  - 706792: PTF 3.3.1-21 introduced a crash when opening a     pptx presentation.

  - 707486: Macro from excel fails on Selection.Copy when     run in Calc.

  - 707779: Disappearing text

  - 708137: xls spreadsheet is extremely slow to open and     check boxes are broken.

  - 708518: Bullet symbol is not rendered correctly in a     specific slide.

  - 710061: ODP export to PDF produces broken images

  - 710920: RPM installation ending with redundant error.

  - 711977: File association for fod* files are missing.

  - 712358: Some extensions broken after upgrading.

  - 715268: Command libreoffice --help does not work when     LibreOffice is already started

  - 715856: LibreOffice:Stable/libreoffice-converter: Bug

  - 715416: Impress crashes starting Slide show in the     context of dual monitors extension mode.

  - 715931: failed to save an odp file.

  - 717262: libtool adds /usr/lib64 into rpath

The remote host is affected by the vulnerability described in GLSA-201209-05 (LibreOffice: Multiple vulnerabilities)

    Multiple vulnerabilities have been found in LibreOffice:
      The Microsoft Word Document parser contains an out-of-bounds read         error (CVE-2011-2713).
      The Raptor RDF parser contains an XML External Entity expansion error         (CVE-2012-0037).
      The graphic loading parser contains an integer overflow error which         could cause a heap-based buffer overflow (CVE-2012-1149).
      Multiple errors in the XML manifest handling code could cause a         heap-based buffer overflow (CVE-2012-2665).
  Impact :

    A remote attacker could entice a user to open a specially crafted       document file using LibreOffice, possibly resulting in execution of       arbitrary code with the privileges of the process or a Denial of Service       condition.
  Workaround :

    There is no known workaround at this time.

Multiple vulnerabilies has been discovered and corrected in libreoffice :

Stack-based buffer overflow in the Lotus Word Pro import filter in LibreOffice before 3.3.3 allows remote attackers to execute arbitrary code via a crafted .lwp file (CVE-2011-2685).

oowriter in OpenOffice.org 3.3.0 and LibreOffice before 3.4.3 allows user-assisted remote attackers to cause a denial of service (crash) via a crafted DOC file that triggers an out-of-bounds read in the DOC sprm parser (CVE-2011-2713).

This update brings a new LibreOffice version 3.4.3 release linked against stdc++ and gcc_s standard libraries available in the Mandriva 2011 and solves installing conflicts with libstdc++ (#64224).

The package clipart-openclipart was dropped from the main repository in the Mandriva 2011. However it is not required having clipart-openclipart installed in order to install libreoffice-openclipart as the LibreOffice still provides some cliparts directly in that package (#63634).

This update fixes some OpenOffice.org leftovers in some packages description replacing that by LibreOffice (#64658).

This update brings new LibreOffice l10n locale packages: Assanese as, Bengali bn, Dzongkha dz, Farsi fa, Irish ga, Galician gl, Gujarati gu, Croatian hr, Kannada kn, Lithuanian lt, Latvian lv, Maithili mai, Malayalam ml, Marathi mr, Ndebele nr, Northern Shoto nso, Oriya or, Punjabi pa_IN, Romanian ro, Secwepemctsin sh, Sinhalese si, Serbian sr, Swati ss, Shoto st, Telugu te, Thai th, Tswana tn, Tsonga ts, Ukrainian uk, Venda ve and Xhosa xh. Help packages are also provided for: bn, dz, gl, gu, hr, si and uk.

Additionally the gaupol packages are being provided to solve a build dependcy of some of the supporting tools already added into 2011.

The updated packages have been upgraded to LibreOffice version 3.4.3 where these isssues has been resolved.

A stack-based buffer overflow was discovered in the Lotus Word Pro import filter in OpenOffice.org. The default compiler options for affected releases should reduce the vulnerability to a denial of service. (CVE-2011-2685)

Huzaifa Sidhpurwala discovered that OpenOffice.org could be made to crash if it opened a specially crafted Word document. (CVE-2011-2713)

Integer overflows were discovered in the graphics loading code of several different image types. If a user were tricked into opening a specially crafted file, an attacker could cause OpenOffice.org to crash or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2012-1149)

Sven Jacobi discovered an integer overflow when processing Escher graphics records. If a user were tricked into opening a specially crafted PowerPoint file, an attacker could cause OpenOffice.org to crash or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2012-2334).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

LibreOffice 3.4 includes many interesting features and fixes, see http://www.libreoffice.org/download/3-4-new-features-and-fixes/

The update fixes the following security issues :

  - 704311: libreoffice Lotus Word Pro filter multiple     vulnerabilities. (CVE-2011-2685)

This update also fixes the following non-security issues :

  - 676858: Document with full page graphic in header will     not allow click-drag or right-click.

  - 681738: DDE link is lost when .xls file is opened/saved     in Calc.

  - 683578: Large xlsx file takes extremely long to open     with Libreoffice calc

  - 684784: Microsoft Office spreadsheet does not display     anything

  - 693238: Column format in docx file is not displayed     correctly.

  - 693477: Format of Word .doc file from HP is bad.

  - 694344: 3rd level bulleted items are not displayed     properly.

  - 695479: L3: RTF file is not displayed correctly by     Writer.

  - 696630: DDE link from Calc to Excel needs Excel open to     update link in Calc.

  - 702506: Writer crashes when opening docx files.

  - 704639: HTML document appearance changes when opened in     open office vs LibreOffice

  - 704642: 16 digit numbers change in LibreOffice when     opening a file created in MS Excel

  - 705949: Information missing from MS Word document when     opened in LibreOffice (w:sdt)

  - 706792: PTF 3.3.1-21 introduced a crash when opening a     pptx presentation.

  - 707486: Macro from excel fails on Selection.Copy when     run in Calc.

  - 707779: Disappearing text

  - 708137: xls spreadsheet is extremely slow to open and     check boxes are broken.

  - 708518: Bullet symbol is not rendered correctly in a     specific slide.

  - 710061: ODP export to PDF produces broken images

  - 710920: RPM installation ending with redundant error.

  - 711977: File association for fod* files are missing.

  - 712358: Some extensions broken after upgrading.

  - 715268: Command libreoffice --help does not work when     LibreOffice is already started

  - 715416: Impress crashes starting Slide show in the     context of dual monitors extension mode.

  - 715931: failed to save an odp file.

LibreOffice 3.4 includes new interesting features and fixes, see http://www.libreoffice.org/download/3-4-new-features-and-fixes/

The update fixes the following security issue :

  - 704311: libreoffice Lotus Word Pro filter multiple     vulnerabilities. (CVE-2011-2685)

  - 722075: LibreOffice: Out-of-bounds read in DOC sprm     (CVE-2011-2713) This update also fixes the following     non-security issues :

  - 653519: Welcome screen missing.

  - 653662: libreoffice build calls mkbundle2 (deprecated)     instead of mkbundle

  - 663622: Writer crash during document save

  - 675868: eliminate wording of ooconvert existed in     loconvert --help

  - 675961: Libreoffice Copy paste of formula in Writer     tables does not work as expected

  - 676858: Document with full page graphic in header will     not allow click-drag or right-click.

  - 677354: The languagetool.rpm does not work as expected

  - 678998: Libre Office does not detect KDE3

  - 680272: Deleting multiple sheets results in run-time     error/crash

  - 681738: DDE link is lost when .xls file is opened/saved     in Calc.

  - 683578: Large xlsx file takes extremely long to open     with Libreoffice calc

  - 684784: Microsoft Office spreadsheet does not display     anything

  - 693238: Column format in docx file is not displayed     correctly.

  - 693477: Format of Word .doc file from HP is bad.

  - 694119: Using File-->Send-->Document as E-mail will     crash Impress

  - 694344: 3rd level bulleted items are not displayed     properly.

  - 695479: RTF file is not displayed correctly by Writer.

  - 696630: DDE link from Calc to Excel needs Excel open to     update link in Calc.

  - 699334: Presentation created in MS Office is missing     text when opened in LibreOffice

  - 701317: xls spreadsheet macro fails with LibreOffice.

  - 702506: Writer crashes when opening docx files.

  - 704639: HTML document appearance changes when opened in     open office vs LibreOffice

  - 704642: 16 digit numbers change in LibreOffice when     opening a file created in MS Excel

  - 705949: Information missing from MS Word document when     opened in LibreOffice (w:sdt)

  - 706792: crash when opening a pptx presentation.

  - 707486: Macro from excel fails on Selection.Copy when     run in Calc.

  - 707779: Disappearing text

  - 708137: xls spreadsheet is extremely slow to open and     check boxes are broken.

  - 708518: Bullet symbol is not rendered correctly in a     specific slide.

  - 710061: ODP export to PDF produces broken images

  - 710920: RPM installation ending with redundant error.

  - 711977: File association for fod* files are missing.

  - 712358: Some extensions broken after upgrading.

  - 715268: Command libreoffice --help does not work when     LibreOffice is already started

  - 715416: Impress crashes starting Slide show in the     context of dual monitors extension mode.

  - 715931: failed to save an odp file.

  - 717262: libtool adds /usr/lib64 into rpath

  - 715856: LibreOffice:Stable/libreoffice-converter: Bug

  - 677354: The languagetool.rpm does not work as expected.

  - 693200: Documents created in MS Office cause LibreOffice     to crash

  - 693386: Documents created in MS Office bring up the     filter selection dialog when opened with LibreOffice

  - 693427: When using QT dialogs and not LibreOffice     dialogs causes LibreOffice to hang when attempting to     save a document

  - 706731: VBA Macros from MS Office Spreadsheet do not     work correct with LibreOffice 3.3.1

Update for OpenOffice.org to handle parsing invalid .doc property lists

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update for LibreOffice to handle parsing invalid .doc property lists

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Red Hat, Inc. security researcher Huzaifa Sidhpurwala reported multiple vulnerabilities in the binary Microsoft Word (doc) file format importer of OpenOffice.org, a full-featured office productivity suite that provides a near drop-in replacement for Microsoft Office.

ID	Name	Product	Family	Severity
77467	GLSA-201408-19 : OpenOffice, LibreOffice: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
75919	openSUSE Security Update : libreoffice-34 (openSUSE-SU-2011:1143-2)	Nessus	SuSE Local Security Checks	high
75611	openSUSE Security Update : libreoffice-34 (openSUSE-SU-2011:1143-1)	Nessus	SuSE Local Security Checks	high
62286	GLSA-201209-05 : LibreOffice: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
61936	Mandriva Linux Security Advisory : libreoffice (MDVSA-2011:172)	Nessus	Mandriva Local Security Checks	high
59833	Ubuntu 10.04 LTS : openoffice.org vulnerabilities (USN-1496-1)	Nessus	Ubuntu Local Security Checks	high
57219	SuSE 10 Security Update : libreoffice (ZYPP Patch Number 7791)	Nessus	SuSE Local Security Checks	high
57118	SuSE 11.1 Security Update : LibreOffice (SAT Patch Number 5271)	Nessus	SuSE Local Security Checks	high
56547	Fedora 14 : openoffice.org-3.3.0-20.8.fc14 (2011-14049)	Nessus	Fedora Local Security Checks	medium
56546	Fedora 15 : libreoffice-3.3.3.1-7.fc15 (2011-14036)	Nessus	Fedora Local Security Checks	medium
56393	Debian DSA-2315-1 : openoffice.org - multiple vulnerabilities	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2011-2713

medium

Tenable Plugins

critical

high

high

high

high

high

high

high

medium

medium

medium