PT-2017-3255 · Document Liberation+3 · Libmwaw+3

David Tardon · Published 2017-04-06 · Updated 2018-04-25 · CVE-2017-9433

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Document Liberation Project libmwaw versions prior to 2017-04-08

Description The issue is caused by a heap-based buffer overflow related to the MsWrd1Parser::readFootnoteCorrespondance function in lib/MsWrd1Parser.cxx. This can be exploited by a remote attacker using a specially crafted document to execute arbitrary code.

Recommendations For versions prior to 2017-04-08, update to a version released after 2017-04-08 to resolve the issue. As a temporary workaround, consider disabling the MsWrd1Parser::readFootnoteCorrespondance function until a patch is available.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

ALT-PU-2018-1170

BDU:2018-00011

CVE-2017-9433

DSA-3875-1

MGASA-2017-0194

OPENSUSE-SU-2024:10959-1

SUSE-SU-2017:1821-1

SUSE-SU-2017:2315-1

SUSE-SU-2018:1076-1

USN-3319-1

Affected Products

Alt Linux

Suse

Ubuntu

Libmwaw

References · 67

• https://bdu.fstec.ru/vul/2018-00011 · Security Note
• https://sourceforge.net/p/libmwaw/libmwaw/ci/68b3b74569881248bfb6cbb4266177cc253b292f · Patch
• https://advisories.mageia.org/MGASA-2017-0194.html · Security Note
• https://security-tracker.debian.org/tracker/CVE-2017-9433 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:1076-1 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3875-1 · Vendor Advisory
• http://debian.org/security/2017/dsa-3875 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-9433 · Security Note
• https://ubuntu.com/security/notices/USN-3319-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2017:2315-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-9433 · Security Note
• https://debian.org/security/2017/dsa-3875 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-9433 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-9433 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-9433 · Vendor Advisory