Home page logo

oss-sec logo oss-sec mailing list archives

CVE-2012-4233: multiple null pointer dereference flaws in LibreOffice/OpenOffice.org
From: Vincent Danen <vdanen () redhat com>
Date: Thu, 1 Nov 2012 14:44:23 -0600

This one took me a bit by surprise.  Debian released an advisory for OOo
and I have no record of this CVE anywhere.  It looks as though it went
public yesterday, and was fixed in upstream, but it's not noted
on the LibreOffice web site at all.

Does anyone have any further details on these issues?  I just filed a
bug in our bugzilla (https://bugzilla.redhat.com/show_bug.cgi?id=872350)
with the following description/references which are all I've been able
to find so far.

I'm not sure on the commit referenced as [4] below; that was the first
one that caught my eye, but I think it might be a red herring as it
doesn't seem to be relevant to any of the file types that are noted as

Any further information anyone has would be sincerely appreciated.

It was reported [1] that LibreOffice suffered from multiple NULL pointer
dereference flaws in at least version and possibly earlier.
These flaws are reported to be corrected in [2], however I am
unable to find a specific reference for this CVE on the LibreOffice
site.  Debian has released an advisory for OpenOffice.org [3] so it
presumably affected as well.

These flaws affect ODT files, ODG files, PPT files (when handling the
PolyPolygon record within an embedded .wmf file), and XLS files.

Checking the LibreOffice git, I see two commits that may be relevant
[4],[5].  However there are a lot of commits to go through between now
and the time that High-Tech Bridge indicates they reported the flaws
upstream (July 26th, 2012).

[1] https://www.htbridge.com/advisory/HTB23106
[2] http://www.libreoffice.org/download/release-notes/#LO355
[3] http://www.debian.org/security/2012/dsa-2570
[4] http://cgit.freedesktop.org/libreoffice/core/commit/?h=libreoffice-3-5-7&id=f95762beb3b5849bfaccd39523a11fe15b191d89
[5] http://cgit.freedesktop.org/libreoffice/core/commit/?h=libreoffice-3-5-7&id=8ca9fb05c9967f11670d045886438ddfa3ac02a7

Vincent Danen / Red Hat Security Response Team

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]