The ole_init function in ole.c in catdoc 0.95 allows remote attackers to cause a denial of service (heap-based buffer underflow and application crash) or possibly have unspecified other impact via a crafted file, i.e., data is written to memory addresses before the beginning of the tmpBuf buffer.

This update for catdoc fixes the following issues :

  - CVE-2017-11110: Attackers may have used specially     crafted files to cause a denial of service through a     heap-based buffer under-flow and application crash, or     have unspecified other impact (boo#1047877)

A heap-based buffer underflow flaw was discovered in catdoc, a text extractor for MS-Office files, which may lead to denial of service (application crash) or have unspecified other impact, if a specially crafted file is processed.

For Debian 7 'Wheezy', these problems have been fixed in version 0.94.4-1.1+deb7u1.

We recommend that you upgrade your catdoc packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A heap-based buffer underflow flaw was discovered in catdoc, a text extractor for MS-Office files, which may lead to denial of service (application crash) or have unspecified other impact, if a specially crafted file is processed.

ID	Name	Product	Family	Severity
101971	openSUSE Security Update : catdoc (openSUSE-2017-841)	Nessus	SuSE Local Security Checks	high
101936	Debian DLA-1037-1 : catdoc security update	Nessus	Debian Local Security Checks	high
101911	Debian DSA-3917-1 : catdoc - security update	Nessus	Debian Local Security Checks	high
101830	openSUSE Security Update : catdoc (openSUSE-2017-828)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2017-11110

high

Tenable Plugins

high

high

high

high