PT-2012-1203 · Document Foundation+4 · Libreoffice+5

Tielei Wang · Published 2012-06-04 · Updated 2023-02-13 · CVE-2012-1149

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions LibreOffice versions prior to 3.5.3 OpenOffice.org versions 3.3, 3.4 Beta, and possibly earlier

Description The issue is related to errors in number processing in the vclmi.dll component of the OpenOffice.org module in LibreOffice. Exploitation of this issue may allow a remote attacker to gain unauthorized access to confidential data, cause a denial of service, or impact data integrity through a specially crafted DOC file using a JPEG image. This can trigger a heap-based buffer overflow, potentially allowing the execution of arbitrary code.

Recommendations For LibreOffice versions prior to 3.5.3, update to version 3.5.3 or later to resolve the issue. For OpenOffice.org versions 3.3 and 3.4 Beta, consider disabling the use of embedded image objects, such as JPEG images in DOC files, until a patch is available. As a temporary workaround, restrict the opening of DOC files with embedded JPEG images to minimize the risk of exploitation.

Fix

DoS

Weakness Enumeration

CWE-189

Related Identifiers

BDU:2020-02952

CESA-2012_0705

CVE-2012-1149

DSA-2473-1

DSA-2487-1

RHSA-2012:0705

RHSA-2012_0705

Affected Products

Centos

Libreoffice

Openoffice

Openoffice.Org

Red Hat

Suse

References · 44

• https://lists.fedoraproject.org/pipermail/package-announce/2012-June/082168.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2012-1149 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-1149 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1149 · Security Note
• http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082168.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-02953 · Security Note
• https://bdu.fstec.ru/vul/2020-02952 · Security Note
• http://lists.fedoraproject.org/pipermail/package-announce/2012-May/081319.html · Vendor Advisory
• http://debian.org/security/2012/dsa-2473 · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-201408-19.xml · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2012:090 · Vendor Advisory
• http://secunia.com/advisories/49392 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2012-0705.html · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2012:091 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2012-1149 · Vendor Advisory