PT-2017-3432 · Apache+1 · Apache Openoffice+2

Publicado 2017-10-26 · Atualizado 2022-02-07 · CVE-2017-12608

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache OpenOffice versions prior to 4.1.4

Description The issue is related to a buffer overflow in the ImportOldFormatStyles function of the DOC file parser, allowing attackers to craft malicious documents. This can cause denial of service, including memory corruption and application crash, and potentially result in arbitrary code execution.

Recommendations For versions prior to 4.1.4, update to version 4.1.4 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the ImportOldFormatStyles function until a patch is available. Restrict access to potentially malicious DOC files to minimize the risk of exploitation.

Correção

DoS

Memory Corruption

Enumeração de Fraquezas

CWE-787

Identificadores relacionados

BDU:2018-00221

CVE-2017-12608

DLA-1214-1

DSA-4022-1

USN-3472-1

Produtos afetados

Apache Openoffice

Openoffice

Ubuntu

Referências · 21

• https://nvd.nist.gov/vuln/detail/CVE-2017-12608 · Nota de Segurança
• https://osv.dev/vulnerability/DSA-4022-1 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2018-00221 · Nota de Segurança
• http://securitytracker.com/id/1039735 · Nota
• https://ubuntu.com/security/CVE-2017-12607 · Aviso do Fabricante
• https://openoffice.org/security/cves/CVE-2017-12608.html · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2017-12608 · Nota de Segurança
• http://securitytracker.com/id/1039733 · Nota
• https://ubuntu.com/security/notices/USN-3472-1 · Aviso do Fabricante
• http://securityfocus.com/bid/101585 · Nota
• https://talosintelligence.com/reports/TALOS-2017-0301 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-12608 · Aviso do Fabricante
• https://debian.org/security/2017/dsa-4022 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2017-12608 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-12608 · Aviso do Fabricante