PT-2012-1203 · Document Foundation+4 · Libreoffice+5
Tielei Wang
·
Publicado
2012-06-04
·
Atualizado
2023-02-13
·
CVE-2012-1149
CVSS v2.0
10
Alta
| Vetor | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
LibreOffice versions prior to 3.5.3
OpenOffice.org versions 3.3, 3.4 Beta, and possibly earlier
Description
The issue is related to errors in number processing in the vclmi.dll component of the OpenOffice.org module in LibreOffice. Exploitation of this issue may allow a remote attacker to gain unauthorized access to confidential data, cause a denial of service, or impact data integrity through a specially crafted DOC file using a JPEG image. This can trigger a heap-based buffer overflow, potentially allowing the execution of arbitrary code.
Recommendations
For LibreOffice versions prior to 3.5.3, update to version 3.5.3 or later to resolve the issue.
For OpenOffice.org versions 3.3 and 3.4 Beta, consider disabling the use of embedded image objects, such as JPEG images in DOC files, until a patch is available.
As a temporary workaround, restrict the opening of DOC files with embedded JPEG images to minimize the risk of exploitation.
Correção
DoS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Centos
Libreoffice
Openoffice
Openoffice.Org
Red Hat
Suse