WP1StylesListener.cpp, WP5StylesListener.cpp, and WP42StylesListener.cpp in libwpd 0.10.1 mishandle iterators, which allows remote attackers to cause a denial of service (heap-based buffer over-read in the WPXTableList class in WPXTable.cpp). This vulnerability can be triggered in LibreOffice before 5.3.7. It may lead to suffering a remote attack against a LibreOffice application.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - WP1StylesListener.cpp, WP5StylesListener.cpp, and WP42StylesListener.cpp in libwpd 0.10.1 mishandle     iterators, which allows remote attackers to cause a denial of service (heap-based buffer over-read in the     WPXTableList class in WPXTable.cpp). This vulnerability can be triggered in LibreOffice before 5.3.7. It     may lead to suffering a remote attack against a LibreOffice application. (CVE-2017-14226)

Note that Nessus relies on the presence of the package as reported by the vendor.

new upstream release

----

  - heap overflow in libwpd

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libwpd fixes the following issues: Security issue fixed :

  - CVE-2017-14226: WP1StylesListener.cpp,     WP5StylesListener.cpp, and WP42StylesListener.cpp in     libwpd 0.10.1 mishandle iterators, which allows remote     attackers to cause a denial of service (heap-based     buffer over-read in the WPXTableList class in     WPXTable.cpp). This vulnerability can be triggered in     LibreOffice before 5.3.7. It may lead to suffering a     remote attack against a LibreOffice application.
    (bnc#1058025) Bugfixes :

  - Fix various crashes, leaks and hangs when reading     damaged files found by oss-fuzz.

  - Fix crash when NULL is passed as input stream.

  - Use symbol visibility on Linux. The library only exports     public functions now.

  - Avoid infinite loop. (libwpd#3)

  - Remove bashism. (libwpd#5)

  - Fix various crashes and hangs when reading broken files     found with the help of american-fuzzy-lop.

  - Make --help output of all command line tools more     help2man-friendly.

  - Miscellaneous fixes and cleanups.

  - Generate manpages for the libwpd-tools

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libwpd fixes the following issues :

Security issue fixed :

  - CVE-2017-14226: WP1StylesListener.cpp,     WP5StylesListener.cpp, and WP42StylesListener.cpp in     libwpd 0.10.1 mishandle iterators, which allows remote     attackers to cause a denial of service (heap-based     buffer over-read in the WPXTableList class in     WPXTable.cpp). This vulnerability can be triggered in     LibreOffice before 5.3.7. It may lead to suffering a     remote attack against a LibreOffice application.
    (bnc#1058025)

Bugfixes :

  - Fix various crashes, leaks and hangs when reading     damaged files found by oss-fuzz.

  - Fix crash when NULL is passed as input stream.

  - Use symbol visibility on Linux. The library only exports     public functions now.

  - Avoid infinite loop. (libwpd#3)

  - Remove bashism. (libwpd#5)

  - Fix various crashes and hangs when reading broken files     found with the help of american-fuzzy-lop.

  - Make --help output of all command line tools more     help2man-friendly.

  - Miscellaneous fixes and cleanups.

  - Generate manpages for the libwpd-tools

This update was imported from the SUSE:SLE-12:Update update project.

According to the version of the libwpd package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - WP1StylesListener.cpp, WP5StylesListener.cpp, and     WP42StylesListener.cpp in libwpd 0.10.1 mishandle     iterators, which allows remote attackers to cause a     denial of service (heap-based buffer over-read in the     WPXTableList class in WPXTable.cpp). This vulnerability     can be triggered in LibreOffice before 5.3.7. It may     lead to suffering a remote attack against a LibreOffice     application.(CVE-2017-14226)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
220645	Linux Distros Unpatched Vulnerability : CVE-2017-14226	Nessus	Misc.	high
105876	Fedora 27 : libwpd (2017-5128c8cfe2)	Nessus	Fedora Local Security Checks	high
104427	SUSE SLED12 Security Update : libwpd (SUSE-SU-2017:2931-1)	Nessus	SuSE Local Security Checks	high
104422	openSUSE Security Update : libwpd (openSUSE-2017-1247)	Nessus	SuSE Local Security Checks	high
104328	EulerOS 2.0 SP2 : libwpd (EulerOS-SA-2017-1275)	Nessus	Huawei Local Security Checks	high
104327	EulerOS 2.0 SP1 : libwpd (EulerOS-SA-2017-1274)	Nessus	Huawei Local Security Checks	high
103335	Fedora 26 : libwpd (2017-63ff51c0dc)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2017-14226

high

Tenable Plugins

high

high

high

high

high

high

high