Integer overflow in wv2 before 0.2.3 might allow context-dependent attackers to execute arbitrary code via a crafted Microsoft Word document.

libwv2 did not sufficiently check the validity of its input. Certain invalid Word documents caused a buffer overflow. By tricking a user into opening a specially crafted Word file with an application that uses libwv2, this could be exploited to execute arbitrary code with the user's privileges.

The only packaged application using this library is KWord.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The wv2 library was updated to fix some boundary checks which could be exploited by maliciously crafted files to access memory outside bounds and possibly execute arbitrary code. (CVE-2006-2197)

Secunia reports :

A vulnerability has been reported in wvWare wv2 Library, which potentially can be exploited by malicious people to compromise an application using the library.

The vulnerability is caused due to an integer overflow error in 'word_helper.h' when handling a Word document. This can be exploited to cause a buffer overflow and may allow arbitrary code execution via a specially crafted Word document.

A boundary checking error has been discovered in wv2, a library for accessing Microsoft Word documents, which can lead to an integer overflow induced by processing word files.

A boundary checking error was discovered in the wv2 library, used for accessing Microsoft Word documents. This error can lead to an integer overflow induced by processing certain Word files.

The updated packages have been patched to correct these issues.

The remote host is affected by the vulnerability described in GLSA-200606-24 (wv2: Integer overflow)

    A boundary checking error was found in wv2, which could lead to an     integer overflow.
  Impact :

    An attacker could execute arbitrary code with the rights of the user     running the program that uses the library via a maliciously crafted     Microsoft Word document.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
27875	Ubuntu 5.04 / 5.10 / 6.06 LTS : wv2 vulnerability (USN-300-1)	Nessus	Ubuntu Local Security Checks	medium
27480	openSUSE 10 Security Update : wv2 (wv2-1687)	Nessus	SuSE Local Security Checks	medium
23850	FreeBSD : wv2 -- Integer Overflow Vulnerability (b9044cc2-8aa5-11db-bd0d-00123ffe8333)	Nessus	FreeBSD Local Security Checks	medium
22642	Debian DSA-1100-1 : wv2 - integer overflow	Nessus	Debian Local Security Checks	medium
21753	Mandrake Linux Security Advisory : wv2 (MDKSA-2006:109)	Nessus	Mandriva Local Security Checks	medium
21750	GLSA-200606-24 : wv2: Integer overflow	Nessus	Gentoo Local Security Checks	medium

Detections

Analytics

CVE-2006-2197

high

Tenable Plugins

medium

medium

medium

medium

medium

medium