A vulnerability in OpenOffice's PPT file parser before 4.1.4, and specifically in PPTStyleSheet, allows attackers to craft malicious documents that cause denial of service (memory corruption and application crash) potentially resulting in arbitrary code execution.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - libreoffice: Multiple out-of-bounds overflows in lwp filter (CVE-2016-0795)

  - libreoffice: heap-based buffer overflow related to the ReadJPEG function (CVE-2017-8358)

  - LibreOffice 3.5.x before 3.5.7.2 and 3.6.x before 3.6.1, and OpenOffice.org (OOo), allows remote attackers     to cause a denial of service (NULL pointer dereference) via a crafted (1) odt file to vcllo.dll, (2) ODG     (Drawing document) file to svxcorelo.dll, (3) PolyPolygon record in a .wmf (Window Meta File) file     embedded in a ppt (PowerPoint) file to tllo.dll, or (4) xls (Excel) file to scfiltlo.dll. (CVE-2012-4233)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

Marcin Noga discovered two vulnerabilities in LibreOffice, which could result in the execution of arbitrary code if a malformed PPT or DOC document is opened.

For Debian 7 'Wheezy', these problems have been fixed in version 1:3.5.4+dfsg2-0+deb7u10.

We recommend that you upgrade your libreoffice packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Marcin Noga discovered two vulnerabilities in LibreOffice, which could result in the execution of arbitrary code if a malformed PPT or DOC document is opened.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3472-1 advisory.

    Marcin Noga discovered that LibreOffice incorrectly handled PPT documents. If a user were tricked into     opening a specially crafted PPT document, a remote attacker could cause LibreOffice to crash, and possibly     execute arbitrary code. (CVE-2017-12607)

    Marcin Noga discovered that LibreOffice incorrectly handled Word documents. If a user were tricked into     opening a specially crafted Word document, a remote attacker could cause LibreOffice to crash, and     possibly execute arbitrary code. (CVE-2017-12608)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Apache OpenOffice installed on the remote host is a version prior to 4.1.4. It is, therefore, affected by multiple Out-of-Bounds vulnerabilities and a file disclosure vulnerability in Calc/Writer.

The Apache Openofffice project reports : CVE-2017-3157: Arbitrary file disclosure in Calc and Writer By exploiting the way OpenOffice renders embedded objects, an attacker could craft a document that allows reading in a file from the user's filesystem. Information could be retrieved by the attacker by, e.g., using hidden sections to store the information, tricking the user into saving the document and convincing the user to sent the document back to the attacker.

The vulnerability is mitigated by the need for the attacker to know the precise file path in the target system, and the need to trick the user into saving the document and sending it back. CVE-2017-9806:
Out-of-Bounds Write in Writer's WW8Fonts Constructor A vulnerability in the OpenOffice Writer DOC file parser, and specifically in the WW8Fonts Constructor, allows attackers to craft malicious documents that cause denial of service (memory corruption and application crash) potentially resulting in arbitrary code execution. CVE-2017-12607:
Out-of-Bounds Write in Impress' PPT Filter A vulnerability in OpenOffice's PPT file parser, and specifically in PPTStyleSheet, allows attackers to craft malicious documents that cause denial of service (memory corruption and application crash) potentially resulting in arbitrary code execution. CVE-2017-12608: Out-of-Bounds Write in Writer's ImportOldFormatStyles A vulnerability in OpenOffice Writer DOC file parser, and specifically in ImportOldFormatStyles, allows attackers to craft malicious documents that cause denial of service (memory corruption and application crash) potentially resulting in arbitrary code execution.

ID	Name	Product	Family	Severity
199335	RHEL 6 : libreoffice (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
105395	Debian DLA-1214-1 : libreoffice security update	Nessus	Debian Local Security Checks	high
104465	Debian DSA-4022-1 : libreoffice - security update	Nessus	Debian Local Security Checks	high
104377	Ubuntu 14.04 LTS : LibreOffice vulnerabilities (USN-3472-1)	Nessus	Ubuntu Local Security Checks	high
104351	Apache OpenOffice < 4.1.4 Multiple Vulnerabilities	Nessus	Windows	high
104162	FreeBSD : Apache OpenOffice -- multiple vulnerabilities (27229c67-b8ff-11e7-9f79-ac9e174be3af)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2017-12607

high

Tenable Plugins

critical

high

high

high

high

high