Home page logo
/

oss-sec logo oss-sec mailing list archives

Re: CVE-2012-4233: multiple null pointer dereference flaws in LibreOffice/OpenOffice.org
From: Marcus Meissner <meissner () suse de>
Date: Fri, 2 Nov 2012 09:07:31 +0100

On Thu, Nov 01, 2012 at 02:44:23PM -0600, Vincent Danen wrote:
This one took me a bit by surprise.  Debian released an advisory for OOo
and I have no record of this CVE anywhere.  It looks as though it went
public yesterday, and was fixed in upstream 3.5.7.2, but it's not noted
on the LibreOffice web site at all.

Does anyone have any further details on these issues?  I just filed a
bug in our bugzilla (https://bugzilla.redhat.com/show_bug.cgi?id=872350)
with the following description/references which are all I've been able
to find so far.

I'm not sure on the commit referenced as [4] below; that was the first
one that caught my eye, but I think it might be a red herring as it
doesn't seem to be relevant to any of the file types that are noted as
affected.

Any further information anyone has would be sincerely appreciated.


I am not sure I am allowed to forward the quoted tdf-security mail
that lists the LibreOffice commits.

But it has in its mailheader:
From:     Caolán McNamara <caolanm () redhat com>
perhaps he can share the details (and I wonder why this caught redhat
by surprise then);

(The whole OpenOffice/LibreOffice security issue handling is not really
good ... long embargoes that get extended wildly even though fixes are in
public GIT already, etc )

Ciao, Marcus


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]