WP1StylesListener.cpp, WP5StylesListener.cpp, and WP42StylesListener.cpp in libwpd 0.10.1 mishandle iterators, which allows remote attackers to cause a denial of service (heap-based buffer over-read in the WPXTableList class in WPXTable.cpp). This vulnerability can be triggered in LibreOffice before 5.3.7. It may lead to suffering a remote attack against a LibreOffice application.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - libwpd: Heap-based buffer over-read in WPXTableList class (CVE-2017-14226)

  - In libwpd 0.10.2, there is a NULL pointer dereference in the function WP6ContentListener::defineTable in     WP6ContentListener.cpp that will lead to a denial of service attack. This is related to WPXTable.h.
    (CVE-2018-19208)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - libwpd: Heap-based buffer over-read in WPXTableList class (CVE-2017-14226)

  - In libwpd 0.10.2, there is a NULL pointer dereference in the function WP6ContentListener::defineTable in     WP6ContentListener.cpp that will lead to a denial of service attack. This is related to WPXTable.h.
    (CVE-2018-19208)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - libwpd: Heap-based buffer over-read in WPXTableList class (CVE-2017-14226)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

new upstream release

----

  - heap overflow in libwpd

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libwpd fixes the following issues: Security issue fixed :

  - CVE-2017-14226: WP1StylesListener.cpp,     WP5StylesListener.cpp, and WP42StylesListener.cpp in     libwpd 0.10.1 mishandle iterators, which allows remote     attackers to cause a denial of service (heap-based     buffer over-read in the WPXTableList class in     WPXTable.cpp). This vulnerability can be triggered in     LibreOffice before 5.3.7. It may lead to suffering a     remote attack against a LibreOffice application.
    (bnc#1058025) Bugfixes :

  - Fix various crashes, leaks and hangs when reading     damaged files found by oss-fuzz.

  - Fix crash when NULL is passed as input stream.

  - Use symbol visibility on Linux. The library only exports     public functions now.

  - Avoid infinite loop. (libwpd#3)

  - Remove bashism. (libwpd#5)

  - Fix various crashes and hangs when reading broken files     found with the help of american-fuzzy-lop.

  - Make --help output of all command line tools more     help2man-friendly.

  - Miscellaneous fixes and cleanups.

  - Generate manpages for the libwpd-tools

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libwpd fixes the following issues :

Security issue fixed :

  - CVE-2017-14226: WP1StylesListener.cpp,     WP5StylesListener.cpp, and WP42StylesListener.cpp in     libwpd 0.10.1 mishandle iterators, which allows remote     attackers to cause a denial of service (heap-based     buffer over-read in the WPXTableList class in     WPXTable.cpp). This vulnerability can be triggered in     LibreOffice before 5.3.7. It may lead to suffering a     remote attack against a LibreOffice application.
    (bnc#1058025)

Bugfixes :

  - Fix various crashes, leaks and hangs when reading     damaged files found by oss-fuzz.

  - Fix crash when NULL is passed as input stream.

  - Use symbol visibility on Linux. The library only exports     public functions now.

  - Avoid infinite loop. (libwpd#3)

  - Remove bashism. (libwpd#5)

  - Fix various crashes and hangs when reading broken files     found with the help of american-fuzzy-lop.

  - Make --help output of all command line tools more     help2man-friendly.

  - Miscellaneous fixes and cleanups.

  - Generate manpages for the libwpd-tools

This update was imported from the SUSE:SLE-12:Update update project.

According to the version of the libwpd package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - WP1StylesListener.cpp, WP5StylesListener.cpp, and     WP42StylesListener.cpp in libwpd 0.10.1 mishandle     iterators, which allows remote attackers to cause a     denial of service (heap-based buffer over-read in the     WPXTableList class in WPXTable.cpp). This vulnerability     can be triggered in LibreOffice before 5.3.7. It may     lead to suffering a remote attack against a LibreOffice     application.(CVE-2017-14226)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
199504	RHEL 6 : libwpd (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
199487	RHEL 5 : libwpd (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
199482	RHEL 7 : libwpd (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
105876	Fedora 27 : libwpd (2017-5128c8cfe2)	Nessus	Fedora Local Security Checks	high
104427	SUSE SLED12 Security Update : libwpd (SUSE-SU-2017:2931-1)	Nessus	SuSE Local Security Checks	high
104422	openSUSE Security Update : libwpd (openSUSE-2017-1247)	Nessus	SuSE Local Security Checks	high
104328	EulerOS 2.0 SP2 : libwpd (EulerOS-SA-2017-1275)	Nessus	Huawei Local Security Checks	high
104327	EulerOS 2.0 SP1 : libwpd (EulerOS-SA-2017-1274)	Nessus	Huawei Local Security Checks	high
103335	Fedora 26 : libwpd (2017-63ff51c0dc)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2017-14226

high

Tenable Plugins

high

high

high

high

high

high

high

high

high