PT-2012-4728 · Kde · Office

Kurt Seifried · Published 2012-08-20 · Updated 2023-02-13 · CVE-2012-3455

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions KOffice versions 2.3.3 and earlier

Description A heap-based buffer overflow issue exists in the read function in filters/words/msword-odf/wv2/src/styles.cpp, which is part of the Microsoft import filter in KOffice. This issue can be triggered by a crafted ODF style in an ODF document, allowing remote attackers to cause a denial of service, resulting in an application crash, and possibly execute arbitrary code.

Recommendations For KOffice versions 2.3.3 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2012-3455

Affected Products

Office

References · 13

• http://lists.opensuse.org/opensuse-updates/2012-08/msg00040.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-3455 · Security Note
• http://ubuntu.com/usn/USN-1526-1 · Vendor Advisory
• http://secunia.com/advisories/50199 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/77483 · Note
• http://media.blackhat.com/bh-us-12/Briefings/C_Miller/BH_US_12_Miller_NFC_attack_surface_WP.pdf · Note
• http://openwall.com/lists/oss-security/2012/08/06/6 · Note
• http://openwall.com/lists/oss-security/2012/08/04/1 · Note
• http://openwall.com/lists/oss-security/2012/08/10/1 · Note
• http://openwall.com/lists/oss-security/2012/08/04/5 · Note
• http://kde.org/info/security/advisory-20120810-1.txt · Note
• http://openwall.com/lists/oss-security/2012/08/06/1 · Note
• http://securityfocus.com/bid/54816 · Note