LibreOffice before 2017-01-02 has an out-of-bounds write caused by a heap-based buffer overflow related to the tools::Polygon::Insert function in tools/source/generic/poly.cxx.

LibreOffice was updated to version 5.3.5.2, bringing new features and enhancements :

Writer :

  - New 'Go to Page' dialog for quickly jumping to another     page.

  - Support for 'Table Styles'.

  - New drawing tools were added.

  - Improvements in the toolbar.

  - Borderless padding is displayed.

Calc :

  - New drawing tools were added.

  - In new installations the default setting for new     documents is now 'Enable wildcards in formulas' instead     of regular expressions.

  - Improved compatibility with ODF 1.2

Impress :

  - Images inserted via 'Photo Album' can now be linked     instead of embedded in the document.

  - When launching Impress, a Template Selector allows you     to choose a Template to start with.

  - Two new default templates: Vivid and Pencil.

  - All existing templates have been improved.

Draw :

  - New arrow endings, including Crow's foot notation's     ones.

Base :

  - Firebird has been upgraded to version 3.0.0. It is     unable to read back Firebird 2.5 data, so embedded     Firebird odb files created in LibreOffice version up to     5.2 cannot be opened with LibreOffice 5.3.

Some security issues have also been fixed :

  - CVE-2017-7870: An out-of-bounds write caused by a     heap-based buffer overflow related to the     tools::Polygon::Insert function.

  - CVE-2017-7882: An out-of-bounds write related to the     HWPFile::TagsRead function.

  - CVE-2017-8358: an out-of-bounds write caused by a     heap-based buffer overflow related to the ReadJPEG     function.

  - CVE-2016-10327: An out-of-bounds write caused by a     heap-based buffer overflow related to the     EnhWMFReader::ReadEnhWMF function.

  - CVE-2017-9433: An out-of-bounds write caused by a     heap-based buffer overflow related to the     MsWrd1Parser::readFootnoteCorrespondance function in     libmwaw.

A comprehensive list of new features and changes in this release is available at: https://wiki.documentfoundation.org/ReleaseNotes/5.3

This update contains binaries for the ports architectures only. This update was imported from the SUSE:SLE-12:Update update project.

LibreOffice was updated to version 5.3.5.2, bringing new features and enhancements: Writer :

  - New 'Go to Page' dialog for quickly jumping to another     page.

  - Support for 'Table Styles'.

  - New drawing tools were added.

  - Improvements in the toolbar.

  - Borderless padding is displayed. Calc :

  - New drawing tools were added.

  - In new installations the default setting for new     documents is now 'Enable wildcards in formulas' instead     of regular expressions.

  - Improved compatibility with ODF 1.2 Impress :

  - Images inserted via 'Photo Album' can now be linked     instead of embedded in the document.

  - When launching Impress, a Template Selector allows you     to choose a Template to start with.

  - Two new default templates: Vivid and Pencil.

  - All existing templates have been improved. Draw :

  - New arrow endings, including Crow's foot notation's     ones. Base :

  - Firebird has been upgraded to version 3.0.0. It is     unable to read back Firebird 2.5 data, so embedded     Firebird odb files created in LibreOffice version up to     5.2 cannot be opened with LibreOffice 5.3. Some security     issues have also been fixed :

  - CVE-2017-7870: An out-of-bounds write caused by a     heap-based buffer overflow related to the     tools::Polygon::Insert function.

  - CVE-2017-7882: An out-of-bounds write related to the     HWPFile::TagsRead function.

  - CVE-2017-8358: an out-of-bounds write caused by a     heap-based buffer overflow related to the ReadJPEG     function.

  - CVE-2016-10327: An out-of-bounds write caused by a     heap-based buffer overflow related to the     EnhWMFReader::ReadEnhWMF function.

  - CVE-2017-9433: An out-of-bounds write caused by a     heap-based buffer overflow related to the     MsWrd1Parser::readFootnoteCorrespondance function in     libmwaw. A comprehensive list of new features and     changes in this release is available at:
    https://wiki.documentfoundation.org/ReleaseNotes/5.3

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for libreoffice is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a drawing program. LibreOffice replaces OpenOffice and provides a similar but enhanced and extended office suite.

Security Fix(es) :

* An out-of-bounds write flaw was found in the way Libreoffice rendered certain documents containing Polygon images. By tricking a user into opening a specially crafted LibreOffice file, an attacker could possibly use this flaw to execute arbitrary code with the privileges of the user opening the file. (CVE-2017-7870)

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.4 Release Notes linked from the References section.

Security Fix(es) :

  - An out-of-bounds write flaw was found in the way     Libreoffice rendered certain documents containing     Polygon images. By tricking a user into opening a     specially crafted LibreOffice file, an attacker could     possibly use this flaw to execute arbitrary code with     the privileges of the user opening the file.
    (CVE-2017-7870)

From Red Hat Security Advisory 2017:1975 :

An update for libreoffice is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a drawing program. LibreOffice replaces OpenOffice and provides a similar but enhanced and extended office suite.

Security Fix(es) :

* An out-of-bounds write flaw was found in the way Libreoffice rendered certain documents containing Polygon images. By tricking a user into opening a specially crafted LibreOffice file, an attacker could possibly use this flaw to execute arbitrary code with the privileges of the user opening the file. (CVE-2017-7870)

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.4 Release Notes linked from the References section.

LibreOffice was updated to version 5.3.3.2, bringing new features and enhancements :

Writer :

  - New 'Go to Page' dialog for quickly jumping to another     page.

  - Support for 'Table Styles'.

  - New drawing tools were added.

  - Improvements in the toolbar.

  - Borderless padding is displayed.

Calc :

  - New drawing tools were added.

  - In new installations the default setting for new     documents is now 'Enable wildcards in formulas' instead     of regular expressions.

  - Improved compatibility with ODF 1.2

Impress :

  - Images inserted via 'Photo Album' can now be linked     instead of embedded in the document.

  - When launching Impress, a Template Selector allows you     to choose a Template to start with.

  - Two new default templates: Vivid and Pencil.

  - All existing templates have been improved.

Draw :

  - New arrow endings, including Crow's foot notation's     ones.

Base :

  - Firebird has been upgraded to version 3.0.0. It is     unable to read back Firebird 2.5 data, so embedded     Firebird odb files created in LibreOffice version up to     5.2 cannot be opened with LibreOffice 5.3.

Some security issues have also been fixed :

  - CVE-2017-7870: An out-of-bounds write caused by a     heap-based buffer overflow related to the     tools::Polygon::Insert function.

  - CVE-2017-7882: An out-of-bounds write related to the     HWPFile::TagsRead function.

  - CVE-2017-8358: an out-of-bounds write caused by a     heap-based buffer overflow related to the ReadJPEG     function.

  - CVE-2016-10327: An out-of-bounds write caused by a     heap-based buffer overflow related to the     EnhWMFReader::ReadEnhWMF function.

  - CVE-2017-9433: An out-of-bounds write caused by a     heap-based buffer overflow related to the     MsWrd1Parser::readFootnoteCorrespondance function in     libmwaw.

A comprehensive list of new features and changes in this release is available at: https://wiki.documentfoundation.org/ReleaseNotes/5.3

This update was imported from the SUSE:SLE-12:Update update project.

LibreOffice was updated to version 5.3.3.2, bringing new features and enhancements: Writer :

  - New 'Go to Page' dialog for quickly jumping to another     page.

  - Support for 'Table Styles'.

  - New drawing tools were added.

  - Improvements in the toolbar.

  - Borderless padding is displayed. Calc :

  - New drawing tools were added.

  - In new installations the default setting for new     documents is now 'Enable wildcards in formulas' instead     of regular expressions.

  - Improved compatibility with ODF 1.2 Impress :

  - Images inserted via 'Photo Album' can now be linked     instead of embedded in the document.

  - When launching Impress, a Template Selector allows you     to choose a Template to start with.

  - Two new default templates: Vivid and Pencil.

  - All existing templates have been improved. Draw :

  - New arrow endings, including Crow's foot notation's     ones. Base :

  - Firebird has been upgraded to version 3.0.0. It is     unable to read back Firebird 2.5 data, so embedded     Firebird odb files created in LibreOffice version up to     5.2 cannot be opened with LibreOffice 5.3. Some security     issues have also been fixed :

  - CVE-2017-7870: An out-of-bounds write caused by a     heap-based buffer overflow related to the     tools::Polygon::Insert function.

  - CVE-2017-7882: An out-of-bounds write related to the     HWPFile::TagsRead function.

  - CVE-2017-8358: an out-of-bounds write caused by a     heap-based buffer overflow related to the ReadJPEG     function.

  - CVE-2016-10327: An out-of-bounds write caused by a     heap-based buffer overflow related to the     EnhWMFReader::ReadEnhWMF function.

  - CVE-2017-9433: An out-of-bounds write caused by a     heap-based buffer overflow related to the     MsWrd1Parser::readFootnoteCorrespondance function in     libmwaw. A comprehensive list of new features and     changes in this release is available at:
    https://wiki.documentfoundation.org/ReleaseNotes/5.3

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201706-28 (LibreOffice: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in LibreOffice. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted file       using LibreOffice, possibly resulting in execution of arbitrary code with       the privileges of the process or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

- CVE-2017-7870 Heap-buffer-overflow in WMF filter

  - CVE-2016-10327 Heap-buffer-overflow in EMF filter

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that LibreOffice incorrectly handled EMF image files. If a user were tricked into opening a specially crafted EMF image file, a remote attacker could cause LibreOffice to crash, and possibly execute arbitrary code.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that a buffer overflow in processing Windows Metafiles may result in denial of service or the execution of arbitrary code if a malformed document is opened.

CVE-2017-3157

Ben Hayak discovered that objects embedded in Writer and Calc documents may result in information disclosure. Please see https://www.libreoffice.org/about-us/security/advisories/cve-2017-3157 / for additional information.

CVE-2017-7870

An out-of-bounds write caused by a heap-based buffer overflow was found in the Polygon class.

For Debian 7 'Wheezy', these problems have been fixed in version 1:3.5.4+dfsg2-0+deb7u9.

We recommend that you upgrade your libreoffice packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of LibreOffice installed on the remote Mac OS X or macOS host is prior to 5.1, 5.1.x prior to 5.1.6, or 5.2.x prior to 5.2.5.
It is, therefore, affected by multiple vulnerabilities :

  - An overflow condition exists when processing EMF files,     specifically in the EnhWMFReader::ReadEnhWMF() function     within file vcl/source/filter/wmf/enhwmf.cxx, due to     improper validation of a certain offset value in the     header that precedes bitmap data. An unauthenticated,     remote attacker can exploit this, via a specially     crafted enhanced metafile file (EMF), to cause a denial     of service condition or the execution of arbitrary code.
    Note that this vulnerability does not affect version     5.1.x. (CVE-2016-10327)

  - A file disclosure vulnerability exists due to a flaw in     the content preview feature when handling embedded     objects. An unauthenticated, remote attacker can exploit     this, via a specially crafted file, to disclose details     of a file on the hosting system. (CVE-2017-3157)

  - An overflow condition exists in the Polygon::Insert()     function within file tools/source/generic/poly.cxx     when processing polygons in Windows metafiles (WMF) that     under certain circumstances result in polygons with more     points than can represented in LibreOffice's internal     polygon class. An unauthenticated, remote attacker can     exploit this, via a specially crafted WMF file, to cause     a denial of service condition or the execution of     arbitrary code. Note that this vulnerability does not     affect version 5.1.x. (CVE-2017-7870)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of LibreOffice installed on the remote Windows host is prior to 5.1, 5.1.x prior to 5.1.6, or 5.2.x prior to 5.2.5. It is, therefore, affected by multiple vulnerabilities :

  - An overflow condition exists when processing EMF files,     specifically in the EnhWMFReader::ReadEnhWMF() function     within file vcl/source/filter/wmf/enhwmf.cxx, due to     improper validation of a certain offset value in the     header that precedes bitmap data. An unauthenticated,     remote attacker can exploit this, via a specially     crafted enhanced metafile file (EMF), to cause a denial     of service condition or the execution of arbitrary code.
    Note that this vulnerability does not affect version     5.1.x. (CVE-2016-10327)

  - A file disclosure vulnerability exists due to a flaw in     the content preview feature when handling embedded     objects. An unauthenticated, remote attacker can exploit     this, via a specially crafted file, to disclose details     of a file on the hosting system. (CVE-2017-3157)

  - An overflow condition exists in the Polygon::Insert()     function within file tools/source/generic/poly.cxx     when processing polygons in Windows metafiles (WMF) that     under certain circumstances result in polygons with more     points than can represented in LibreOffice's internal     polygon class. An unauthenticated, remote attacker can     exploit this, via a specially crafted WMF file, to cause     a denial of service condition or the execution of     arbitrary code. Note that this vulnerability does not     affect version 5.1.x. (CVE-2017-7870)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
103284	openSUSE Security Update : libreoffice (openSUSE-2017-1048)	Nessus	SuSE Local Security Checks	critical
102911	SUSE SLED12 Security Update : libreoffice (SUSE-SU-2017:2315-1)	Nessus	SuSE Local Security Checks	critical
102746	CentOS 7 : libreoffice (CESA-2017:1975)	Nessus	CentOS Local Security Checks	critical
102646	Scientific Linux Security Update : libreoffice on SL7.x x86_64 (20170801)	Nessus	Scientific Linux Local Security Checks	critical
102291	Oracle Linux 7 : libreoffice (ELSA-2017-1975)	Nessus	Oracle Linux Local Security Checks	critical
102107	RHEL 7 : libreoffice (RHSA-2017:1975)	Nessus	Red Hat Local Security Checks	critical
101517	openSUSE Security Update : libreoffice (openSUSE-2017-807)	Nessus	SuSE Local Security Checks	critical
101353	SUSE SLED12 Security Update : libreoffice (SUSE-SU-2017:1821-1)	Nessus	SuSE Local Security Checks	critical
101074	GLSA-201706-28 : LibreOffice: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
100192	Fedora 24 : 1:libreoffice (2017-7a7d2044c9)	Nessus	Fedora Local Security Checks	critical
99965	Ubuntu 14.04 LTS / 16.04 LTS : LibreOffice vulnerabilities (USN-3273-1)	Nessus	Ubuntu Local Security Checks	critical
99717	Debian DSA-3837-1 : libreoffice - security update	Nessus	Debian Local Security Checks	critical
99604	Debian DLA-910-1 : libreoffice security update	Nessus	Debian Local Security Checks	critical
97497	LibreOffice < 5.1.6 / 5.2.5 / 5.3.0 Multiple Vulnerabilities (macOS)	Nessus	MacOS X Local Security Checks	critical
97496	LibreOffice < 5.1.6 / 5.2.5 / 5.3.0 Multiple Vulnerabilities	Nessus	Windows	critical

Detections

Analytics

CVE-2017-7870

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical