Integer overflow in filter/source/msfilter/msdffimp.cxx in OpenOffice.org (OOo) 3.3, 3.4 Beta, and possibly earlier, and LibreOffice before 3.5.3, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the length of an Escher graphics record in a PowerPoint (.ppt) document, which triggers a buffer overflow.

The remote host is affected by the vulnerability described in GLSA-201408-19 (OpenOffice, LibreOffice: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in OpenOffice and       Libreoffice. Please review the CVE identifiers referenced below for       details.
  Impact :

    A remote attacker could entice a user to open a specially crafted file       using OpenOffice, possibly resulting in execution of arbitrary code with       the privileges of the process, a Denial of Service condition, execution       of arbitrary Python code, authentication bypass, or reading and writing       of arbitrary files.
  Workaround :

    There is no known workaround at this time.

From Red Hat Security Advisory 2012:0705 :

Updated openoffice.org packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

OpenOffice.org is an office productivity suite that includes desktop applications, such as a word processor, spreadsheet application, presentation manager, formula editor, and a drawing program.

An integer overflow flaw, leading to a buffer overflow, was found in the way OpenOffice.org processed an invalid Escher graphics records length in Microsoft Office PowerPoint documents. An attacker could provide a specially crafted Microsoft Office PowerPoint document that, when opened, would cause OpenOffice.org to crash or, potentially, execute arbitrary code with the privileges of the user running OpenOffice.org. (CVE-2012-2334)

Multiple integer overflow flaws, leading to heap-based buffer overflows, were found in the JPEG, PNG, and BMP image file reader implementations in OpenOffice.org. An attacker could provide a specially crafted JPEG, PNG, or BMP image file that, when opened in an OpenOffice.org application, would cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application. (CVE-2012-1149)

Upstream acknowledges Sven Jacobi as the original reporter of CVE-2012-2334, and Tielei Wang via Secunia SVCRP as the original reporter of CVE-2012-1149.

All OpenOffice.org users are advised to upgrade to these updated packages, which contain backported patches to correct these issues.
All running instances of OpenOffice.org applications must be restarted for this update to take effect.

The version of IBM Lotus Symphony is a version prior to 3.0.1 Fix Pack 2.  Such versions are affected by multiple vulnerabilities :

  - Flaws exist in the way certain XML components are     processed for external entities in ODF documents.
    These flaws can be utilized to access and inject the     content of local files into an ODF document without a     user's knowledge or permission, or inject arbitrary code     that would be executed when opened by the user.
    (CVE-2012-0037)

  - An integer overflow error exists in 'vclmi.dll' that     can allow heap-based buffer overflows when handling     embedded image objects. (CVE-2012-1149)

  - Memory checking errors exist in     'filter/source/msfilter msdffimp.cxx' that can be     triggered when processing PowerPoint graphics records.
    These errors can allow denial of service attacks.
    (CVE-2012-2334)

  - Errors exist related to XML tag handling and base64     decoding that can lead to heap-based buffer overflows.
    (CVE-2012-2665)

Security issues were identified and fixed in libreoffice :

An integer overflow vulnerability in the libreoffice graphic loading code could allow a remote attacker to cause a denial of service (application crash) or potentially execute arbitrary code (CVE-2012-1149).

An integer overflow flaw, leading to buffer overflow, was found in the way libreoffice processed invalid Escher graphics records length in PowerPoint documents. An attacker could provide a specially crafted PowerPoint document that, when opened, would cause libreoffice to crash or, potentially, execute arbitrary code with the privileges of the user running libreoffice (CVE-2012-2334).

libreoffice for Mandriva Linux 2011 has been upgraded to the 3.5.4 version which is not vulnerable to these issues.

OpenOffice.org is an office productivity suite that includes desktop applications, such as a word processor, spreadsheet application, presentation manager, formula editor, and a drawing program.

An integer overflow flaw, leading to a buffer overflow, was found in the way OpenOffice.org processed an invalid Escher graphics records length in Microsoft Office PowerPoint documents. An attacker could provide a specially crafted Microsoft Office PowerPoint document that, when opened, would cause OpenOffice.org to crash or, potentially, execute arbitrary code with the privileges of the user running OpenOffice.org. (CVE-2012-2334)

Multiple integer overflow flaws, leading to heap-based buffer overflows, were found in the JPEG, PNG, and BMP image file reader implementations in OpenOffice.org. An attacker could provide a specially crafted JPEG, PNG, or BMP image file that, when opened in an OpenOffice.org application, would cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application. (CVE-2012-1149)

All OpenOffice.org users are advised to upgrade to these updated packages, which contain backported patches to correct these issues.
All running instances of OpenOffice.org applications must be restarted for this update to take effect.

A stack-based buffer overflow was discovered in the Lotus Word Pro import filter in OpenOffice.org. The default compiler options for affected releases should reduce the vulnerability to a denial of service. (CVE-2011-2685)

Huzaifa Sidhpurwala discovered that OpenOffice.org could be made to crash if it opened a specially crafted Word document. (CVE-2011-2713)

Integer overflows were discovered in the graphics loading code of several different image types. If a user were tricked into opening a specially crafted file, an attacker could cause OpenOffice.org to crash or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2012-1149)

Sven Jacobi discovered an integer overflow when processing Escher graphics records. If a user were tricked into opening a specially crafted PowerPoint file, an attacker could cause OpenOffice.org to crash or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2012-2334).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Integer overflows were discovered in the graphics loading code of several different image types. If a user were tricked into opening a specially crafted file, an attacker could cause LibreOffice to crash or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2012-1149)

Sven Jacobi discovered an integer overflow when processing Escher graphics records. If a user were tricked into opening a specially crafted PowerPoint file, an attacker could cause LibreOffice to crash or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2012-2334).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that OpenOffice.org would not properly process crafted document files, possibly leading to arbitrary code execution.

  - CVE-2012-1149     Integer overflows in PNG image handling.

  - CVE-2012-2334     Integer overflow in operator new[] invocation and     heap-based buffer overflow inside the MS-ODRAW parser.

CVE-2012-1149 An integer overflow vulnerability in LibreOffice graphic loading code CVE-2012-2334 Denial of Service with malformed .ppt files

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated openoffice.org packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

OpenOffice.org is an office productivity suite that includes desktop applications, such as a word processor, spreadsheet application, presentation manager, formula editor, and a drawing program.

An integer overflow flaw, leading to a buffer overflow, was found in the way OpenOffice.org processed an invalid Escher graphics records length in Microsoft Office PowerPoint documents. An attacker could provide a specially crafted Microsoft Office PowerPoint document that, when opened, would cause OpenOffice.org to crash or, potentially, execute arbitrary code with the privileges of the user running OpenOffice.org. (CVE-2012-2334)

Multiple integer overflow flaws, leading to heap-based buffer overflows, were found in the JPEG, PNG, and BMP image file reader implementations in OpenOffice.org. An attacker could provide a specially crafted JPEG, PNG, or BMP image file that, when opened in an OpenOffice.org application, would cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application. (CVE-2012-1149)

Upstream acknowledges Sven Jacobi as the original reporter of CVE-2012-2334, and Tielei Wang via Secunia SVCRP as the original reporter of CVE-2012-1149.

All OpenOffice.org users are advised to upgrade to these updated packages, which contain backported patches to correct these issues.
All running instances of OpenOffice.org applications must be restarted for this update to take effect.

The version of Apache OpenOffice installed on the remote host is prior to 3.4.0. It is, therefore, affected by several memory corruption issues :

  - An integer overflow error exists in 'vclmi.dll' that     could allow heap-based buffer overflows when handling     embedded image objects. (CVE-2012-1149)

  - A memory overwrite error exists in 'libwpd' that could     be triggered when processing WordPerfect documents. This     memory overwrite may lead to arbitrary code execution.
    (CVE-2012-2149)

  - Memory checking errors exist in     'filter/source/msfilter msdffimp.cxx' that could be     triggered when processing PowerPoint graphics records.
    These errors could allow denial of service attacks.
    (CVE-2012-2334)

A version of LibreOffice prior to 3.5.3 is installed on the remote Windows host. It is, therefore, reportedly affected by multiple memory corruption vulnerabilities :

  - An integer overflow vulnerability exists in the     graphics object loading code that could allow a remote     attacker to execute arbitrary code or cause an     application crash. (CVE-2012-1149)

  - A denial of service vulnerability exists in the     PowerPoint presentation import code. (CVE-2012-2334)

  - A memory corruption vulnerability in the code for     handling .RTF files.

ID	Name	Product	Family	Severity
77467	GLSA-201408-19 : OpenOffice, LibreOffice: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
68534	Oracle Linux 6 : openoffice.org (ELSA-2012-0705)	Nessus	Oracle Linux Local Security Checks	high
63266	IBM Lotus Symphony < 3.0.1 Fix Pack 2 Multiple Vulnerabilities	Nessus	Windows	high
61955	Mandriva Linux Security Advisory : libreoffice (MDVSA-2012:091)	Nessus	Mandriva Local Security Checks	high
61321	Scientific Linux Security Update : openoffice.org on SL5.x, SL6.x i386/x86_64 (20120604)	Nessus	Scientific Linux Local Security Checks	high
59833	Ubuntu 10.04 LTS : openoffice.org vulnerabilities (USN-1496-1)	Nessus	Ubuntu Local Security Checks	high
59832	Ubuntu 11.04 / 11.10 : libreoffice, libreoffice-l10n vulnerabilities (USN-1495-1)	Nessus	Ubuntu Local Security Checks	high
59765	Debian DSA-2487-1 : openoffice.org - buffer overflow	Nessus	Debian Local Security Checks	high
59483	Fedora 15 : libreoffice-3.3.4.1-5.fc15 (2012-8114)	Nessus	Fedora Local Security Checks	high
59378	CentOS 5 / 6 : openoffice.org (CESA-2012:0705)	Nessus	CentOS Local Security Checks	high
59363	RHEL 5 / 6 : openoffice.org (RHSA-2012:0705)	Nessus	Red Hat Local Security Checks	high
59191	Apache OpenOffice < 3.4.0 Multiple Memory Corruption Vulnerabilities	Nessus	Windows	high
59180	LibreOffice < 3.5.3 Multiple Memory Corruption Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2012-2334

critical

Tenable Plugins

critical

high

high

high

high

high

high

high

high

high

high

high

high