Gentoo Linux Security Advisory GLSA 200704-12 - John Heasman of NGSSoftware has discovered a stack-based buffer overflow in the StarCalc parser and an input validation error when processing metacharacters in a link. Also OpenOffice.Org includes code from libwpd making it vulnerable to heap-based overflows when converting WordPerfect document tables (GLSA 200704-07). Versions less than 2.1.0-r1 are affected.
74b0fcdf442f7d50af5cc91ca0bc3cc8490733897b5f1c1544134f2e17d01f6bGentoo Linux Security Advisory GLSA 200704-07 - libwpd contains heap-based overflows in two functions that convert WordPerfect document tables. In addition, it contains an integer overflow in a text-conversion function. Versions less than 0.8.9 are affected.
1e9fdb2a877b8516bd068fa660a685d9c1d80a4f9b8522488869b75c22e668a7Debian Security Advisory 1270-2 - Several security related problems have been discovered in OpenOffice.org, the free office suite. iDefense reported several integer overflow bugs in libwpd, a library for handling WordPerfect documents that is included in OpenOffice.org. Attackers are able to exploit these with carefully crafted WordPerfect files that could cause an application linked with libwpd to crash or possibly execute arbitrary code. Next Generation Security discovered that the StarCalc parser in OpenOffice.org contains an easily exploitable stack overflow that could be used exploited by a specially crafted document to execute arbitrary code. It has been reported that OpenOffice.org does not escape shell meta characters and is hence vulnerable to execute arbitrary shell commands via a specially crafted document after the user clicked to a prepared link.
6a98de9d6726afda9654896eb2376068ddfa560a6b112aa5a9e545afb183e78dDebian Security Advisory 1270-1 - iDefense reported several integer overflow bugs in libwpd, a library for handling WordPerfect documents that is included in OpenOffice.org. Attackers are able to exploit these with carefully crafted WordPerfect files that could cause an application linked with libwpd to crash or possibly execute arbitrary code. Next Generation Security discovered that the StarCalc parser in OpenOffice.org contains an easily exploitable stack overflow that could be used exploited by a specially crafted document to execute arbitrary code. It has been reported that OpenOffice.org does not escape shell meta characters and is hence vulnerable to execute arbitrary shell commands via a specially crafted document after the user clicked to a prepared link.
0ddd6cae3eb3b01c6b9bd54992ea7953866af3e4536c39cf818f233f33040e70Ubuntu Security Notice 437-1 - Sean Larsson of iDefense Labs discovered that libwpd was vulnerable to integer overflows. If a user were tricked into opening a specially crafted WordPerfect document with an application that used libwpd, an attacker could execute arbitrary code with user privileges.
6261198527440a64e6ab828451da743f2632f910ce6b6f92324a199b7864d8a8Debian Security Advisory 1268-1 - iDefense reported several integer overflow bugs in libwpd, a library for handling WordPerfect documents. Attackers were able to exploit these with carefully crafted Word Perfect files that could cause an application linked with libwpd to crash or possibly execute arbitrary code.
af74ed90eebd99b7af32bad5fe7dc670c16767dc8b02be0724f3e3a263ce86acMandriva Linux Security Advisory - iDefense reported several overflow bugs in libwpd. An attacker could create a carefully crafted Word Perfect file that could cause an application linked with libwpd, such as OpenOffice, to crash or possibly execute arbitrary code if the file was opened by a victim. OpenOffice.org-2.X contains an embedded copy of libpwd, and as such is susceptible to the same issues.
3a5e17e1a6d77b0406dc4b1219ef1a51f591006ed7027e596dff2f588114fd40Mandriva Linux Security Advisory - iDefense reported several overflow bugs in libwpd. An attacker could create a carefully crafted Word Perfect file that could cause an application linked with libwpd, such as OpenOffice, to crash or possibly execute arbitrary code if the file was opened by a victim.
a91dc13498879339910d9fdeead6ad0d6631764467a2ffdc88e2bf2f2bcfcb21iDefense Security Advisory 03.16.07 - Remote exploitation of multiple buffer overflow vulnerabilities in libwpd, as included in various vendors' operating system distributions, could allow an attacker to execute arbitrary code. One problem specifically exists in the WP6GeneralTextPacket::_readContents function. This function reads in a series of integer values and sums them. This sum is then used to allocate a block of memory from the heap. The function then copies data from the file into the buffer using each operand from the addition as the number of bytes to copy. The summing operation leads to an integer overflow, and the buffer can then be overflowed by the copy operations. Two additional problems exist in the WP3TablesGroup::_readContents() and WP5DefinitionGroup_DefineTablesSubGroup::WP5DefinitionGroup_DefineTablesSubGroup() functions. These functions read an integer value from an attacker supplied file, and uses the value as a loop counter. In the loop a statically sized buffer is filled with arbitrary data from the file. This leads to an exploitable heap overflow. iDefense has confirmed the existence of this vulnerability in libwpd version 0.8.7. Previous versions may also be affected. This library is used by applications such as Abiword, Kword, and Open Office.
35c9b92151d5c22b47e301ead4d95cde8f7d58436bbd3c61f01ecf57656db772
© 2022 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed