Integer overflow in the WP6GeneralTextPacket::_readContents function in WordPerfect Document importer/exporter (libwpd) before 0.8.9 allows user-assisted remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted WordPerfect file, a different vulnerability than CVE-2007-0002.

StarSuite 8 (Solaris_x86): Update 18.
Date this patch was last updated by Sun : Mar/15/11

StarOffice 8 (Solaris_x86): Update 18.
Date this patch was last updated by Sun : Mar/15/11

StarSuite 8 (Solaris): Update 18.
Date this patch was last updated by Sun : Mar/15/11

StarOffice 8 (Solaris): Update 18.
Date this patch was last updated by Sun : Mar/15/11

From Red Hat Security Advisory 2007:0033 :

Updated openoffice.org packages to correct security issues are now available for Red Hat Enterprise Linux 3 and 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

OpenOffice.org is an office productivity suite that includes desktop applications such as a word processor, spreadsheet, presentation manager, formula editor, and drawing program.

iDefense reported an integer overflow flaw in libwpd, a library used internally to OpenOffice.org for handling Word Perfect documents. An attacker could create a carefully crafted Word Perfect file that could cause OpenOffice.org to crash or possibly execute arbitrary code if the file was opened by a victim. (CVE-2007-1466)

John Heasman discovered a stack overflow in the StarCalc parser in OpenOffice.org. An attacker could create a carefully crafted StarCalc file that could cause OpenOffice.org to crash or possibly execute arbitrary code if the file was opened by a victim. (CVE-2007-0238)

Flaws were discovered in the way OpenOffice.org handled hyperlinks. An attacker could create an OpenOffice.org document which could run commands if a victim opened the file and clicked on a malicious hyperlink. (CVE-2007-0239)

All users of OpenOffice.org are advised to upgrade to these updated packages, which contain backported fixes for these issues.

Red Hat would like to thank Fridrich Strba for alerting us to the issue CVE-2007-1466 and providing a patch, and John Heasman for CVE-2007-0238.

Sean Larsson of iDefense Labs discovered that libwpd was vulnerable to integer overflows. If a user were tricked into opening a specially crafted WordPerfect document with an application that used libwpd, an attacker could execute arbitrary code with user privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated libwpd packages to correct a security issue are now available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

libwpd is a library for reading and converting Word Perfect documents.

iDefense reported several overflow bugs in libwpd. An attacker could create a carefully crafted Word Perfect file that could cause an application linked with libwpd, such as OpenOffice, to crash or possibly execute arbitrary code if the file was opened by a victim.
(CVE-2007-0002)

All users are advised to upgrade to these updated packages, which contain a backported fix for this issue.

Red Hat would like to thank Fridrich Strba for alerting us to these issues and providing a patch.

The remote host is affected by the vulnerability described in GLSA-200704-07 (libwpd: Multiple vulnerabilities)

    libwpd contains heap-based overflows in two functions that convert     WordPerfect document tables. In addition, it contains an integer     overflow in a text-conversion function.
  Impact :

    An attacker could entice a user to convert a specially crafted     WordPerfect file, resulting in a crash or possibly the execution of     arbitrary code with the rights of the user running libwpd.
  Workaround :

    There is no known workaround at this time.

The remote host is running a version of Sun Microsystems OpenOffice.org that is prior to version 2.2. It is, therefore, affected by a stack-based buffer overflow vulnerability in its handling of StarCalc documents. If a remote attacker can trick a user into opening a specially crafted StarCalc document, the attacker can execute arbitrary code on the remote host subject to the user's privileges.

In addition, versions 2.0 - 2.1 reportedly have a heap-based buffer overflow vulnerability that can be triggered when importing a specially crafted WordPerfect document, resulting in arbitrary code execution.

Updated openoffice.org packages to correct security issues are now available for Red Hat Enterprise Linux 3 and 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

OpenOffice.org is an office productivity suite that includes desktop applications such as a word processor, spreadsheet, presentation manager, formula editor, and drawing program.

iDefense reported an integer overflow flaw in libwpd, a library used internally to OpenOffice.org for handling Word Perfect documents. An attacker could create a carefully crafted Word Perfect file that could cause OpenOffice.org to crash or possibly execute arbitrary code if the file was opened by a victim. (CVE-2007-1466)

John Heasman discovered a stack overflow in the StarCalc parser in OpenOffice.org. An attacker could create a carefully crafted StarCalc file that could cause OpenOffice.org to crash or possibly execute arbitrary code if the file was opened by a victim. (CVE-2007-0238)

Flaws were discovered in the way OpenOffice.org handled hyperlinks. An attacker could create an OpenOffice.org document which could run commands if a victim opened the file and clicked on a malicious hyperlink. (CVE-2007-0239)

All users of OpenOffice.org are advised to upgrade to these updated packages, which contain backported fixes for these issues.

Red Hat would like to thank Fridrich Strba for alerting us to the issue CVE-2007-1466 and providing a patch, and John Heasman for CVE-2007-0238.

CVE-2007-0002 buffer overflows in wordperfect document parsing

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

iDefense reported several overflow bugs in libwpd. An attacker could create a carefully crafted Word Perfect file that could cause an application linked with libwpd, such as OpenOffice, to crash or possibly execute arbitrary code if the file was opened by a victim.

OpenOffice.org-2.X contains an embedded copy of libpwd, and as such is susceptible to the same issues.

Updated packages have been rebuilt using the system libwpd to address this issue.

iDefense reported several overflow bugs in libwpd. An attacker could create a carefully crafted Word Perfect file that could cause an application linked with libwpd, such as OpenOffice, to crash or possibly execute arbitrary code if the file was opened by a victim.

Updated packages have been patched to address this issue.

iDefense reported several integer overflow bugs in libwpd, a library for handling WordPerfect documents. Attackers were able to exploit these with carefully crafted Word Perfect files that could cause an application linked with libwpd to crash or possibly execute arbitrary code.

ID	Name	Product	Family	Severity
107858	Solaris 10 (x86) : 120190-23	Nessus	Solaris Local Security Checks	high
107857	Solaris 10 (x86) : 120186-23	Nessus	Solaris Local Security Checks	high
107356	Solaris 10 (sparc) : 120189-23	Nessus	Solaris Local Security Checks	high
107355	Solaris 10 (sparc) : 120185-23	Nessus	Solaris Local Security Checks	high
67443	Oracle Linux 3 / 4 : openoffice.org (ELSA-2007-0033)	Nessus	Oracle Linux Local Security Checks	high
28033	Ubuntu 5.10 / 6.06 LTS / 6.10 : libwpd vulnerability (USN-437-1)	Nessus	Ubuntu Local Security Checks	high
25312	RHEL 5 : libwpd (RHSA-2007:0055)	Nessus	Red Hat Local Security Checks	high
25020	GLSA-200704-07 : libwpd: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
25004	Sun OpenOffice.org < 2.2 Multiple Vulnerabilities	Nessus	Windows	high
24896	RHEL 3 / 4 : openoffice.org (RHSA-2007:0033)	Nessus	Red Hat Local Security Checks	high
24884	Fedora Core 5 : libwpd-0.8.9-1.fc5 (2007-350)	Nessus	Fedora Local Security Checks	high
24877	CentOS 3 / 4 : openoffice.org (CESA-2007:0033)	Nessus	CentOS Local Security Checks	high
24843	Mandrake Linux Security Advisory : openoffice.org (MDKSA-2007:064)	Nessus	Mandriva Local Security Checks	high
24842	Mandrake Linux Security Advisory : libwpd (MDKSA-2007:063)	Nessus	Mandriva Local Security Checks	high
24835	Debian DSA-1268-1 : libwpd - integer overflow	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2007-1466

critical

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high