PT-2017-2096 · Document Foundation+3 · Libreoffice+3

Publicado 2017-02-16 · Atualizado 2024-06-15 · CVE-2016-10327

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LibreOffice versions prior to 2016-12-22

Description The issue is caused by a heap-based buffer overflow related to the EnhWMFReader::ReadEnhWMF function in vcl/source/filter/wmf/enhwmf.cxx. This can lead to an out-of-bounds write, potentially allowing a remote attacker to execute arbitrary code.

Recommendations For versions prior to 2016-12-22, update to a version released after 2016-12-22 to resolve the issue. As a temporary workaround, consider disabling the EnhWMFReader::ReadEnhWMF function until a patch is available.

Correção

Out of bounds Read

Memory Corruption

Enumeração de Fraquezas

CWE-125

CWE-787

Identificadores relacionados

ALT-PU-2017-1170

BDU:2017-01264

CVE-2016-10327

OPENSUSE-SU-2024:10983-1

SUSE-SU-2017:1821-1

SUSE-SU-2017:2315-1

USN-3273-1

Produtos afetados

Alt Linux

Libreoffice

Suse

Ubuntu

Referências · 74

• https://github.com/LibreOffice/core/commit/7485fc2a1484f31631f62f97e5c64c0ae74c6416 · Correção
• https://suse.com/support/update/announcement/2017/suse-su-20172315-1 · Nota
• https://bdu.fstec.ru/vul/2017-01264 · Nota de Segurança
• https://suse.com/security/cve/CVE-2019-9848 · Nota
• https://suse.com/security/cve/CVE-2018-1055 · Nota
• https://cve.org/CVERecord?id=CVE-2016-10327 · Nota de Segurança
• https://suse.com/security/cve/CVE-2007-0238 · Nota
• https://ubuntu.com/security/CVE-2016-10327 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2017-3157 · Nota
• https://ubuntu.com/security/CVE-2017-7870 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2019-9855 · Nota
• https://osv.dev/vulnerability/SUSE-SU-2017:2315-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2006-3117 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-10327 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2006-2199 · Nota