PT-2012-1024 · Document Foundation+5 · Libreoffice+5

Timothy D. Morgan · Published 2012-03-22 · Updated 2024-12-25 · CVE-2012-0037

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Redland Raptor (aka libraptor) versions prior to 2.0.7 LibreOffice versions prior to 3.4.6 and 3.5.x prior to 3.5.1 OpenOffice versions 3.3 and 3.4 Beta

Description The issue allows user-assisted remote attackers to read arbitrary files via a crafted XML external entity (XXE) declaration and reference in an RDF document. This can lead to the disclosure of confidential information. The exploitation of this issue requires active actions from the user.

Recommendations For Redland Raptor (aka libraptor) versions prior to 2.0.7, update to version 2.0.7 or later. For LibreOffice versions prior to 3.4.6, update to version 3.4.6 or later. For LibreOffice version 3.5.x prior to 3.5.1, update to version 3.5.1 or later. For OpenOffice versions 3.3 and 3.4 Beta, consider updating to a newer version that is not affected by this issue, as specific fixes for these versions may not be available. As a temporary workaround, consider restricting the use of RDF documents and XML external entity declarations until a patch is available.

Exploit

Fix

XXE

Information Disclosure

Weakness Enumeration

CWE-611

CWE-200

Related Identifiers

BDU:2015-01454

CESA-2012_0410

CVE-2012-0037

DSA-2438-1

RHSA-2012:0410

RHSA-2012:0411

RHSA-2012_0410

RHSA-2012_0411

SUSE-SU-2012_0413-1

SUSE-SU-2012_0481-1

Affected Products

Centos

Libreoffice

Openoffice

Red Hat

Redland Raptor

Suse

References · 40

• 🔥 http://openwall.com/lists/oss-security/2012/03/27/4 · Exploit
• https://github.com/dajobe/raptor/commit/a676f235309a59d4aa78eeffd2574ae5d341fcb0 · Patch
• https://linux.oracle.com/errata/ELSA-2012-0410.html · Vendor Advisory
• http://debian.org/security/2012/dsa-2438 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2012-0037 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2012-0410.html · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-201408-19.xml · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0037 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2012-0037 · Security Note
• http://secunia.com/advisories/48542 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-01454 · Security Note
• http://openoffice.org/security/cves/CVE-2012-0037.html · Patch
• http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077708.html · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2012:061 · Vendor Advisory
• http://secunia.com/advisories/48479 · Vendor Advisory