Document Liberation Project libmwaw before 2017-04-08 has an out-of-bounds write caused by a heap-based buffer overflow related to the MsWrd1Parser::readFootnoteCorrespondance function in lib/MsWrd1Parser.cxx.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - libmwaw: Out-of-bounds write in the MsWrd1Parser::readFootnoteCorrespondence function (CVE-2017-9433)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

According to the version of the libmwaw package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Document Liberation Project libmwaw before 2017-04-08     has an out-of-bounds write caused by a heap-based     buffer overflow related to the     MsWrd1Parser::readFootnoteCorrespondance function in     lib/MsWrd1Parser.cxx.(CVE-2017-9433)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

LibreOffice was updated to version 6.0.3. Following new features were added :

  - The Notebookbar, although still an experimental feature,     has been enriched with two new variants: Grouped Bar     Full for Writer, Calc and Impress, and Tabbed Compact     for Writer. The Special Characters dialog has been     reworked, with the addition of lists for Recent and     Favorite characters, along with a Search field. The     Customize dialog has also been redesigned, and is now     more modern and intuitive.

  - In Writer, a Form menu has been added, making it easier     to access one of the most powerful     &Atilde;&cent;&Acirc;&#128;&Acirc;&#147; and often     unknown &Atilde;&cent;&Acirc;&#128;&Acirc;&#147;
    LibreOffice features: the ability to design forms, and     create standards-compliant PDF forms. The Find toolbar     has been enhanced with a drop-down list of search types,     to speed up navigation. A new default table style has     been added, together with a new collection of table     styles to reflect evolving visual trends.

  - The Mail Merge function has been improved, and it is now     possible to use either a Writer document or an XLSX file     as data source.

  - In Calc, ODF 1.2-compliant functions SEARCHB, FINDB and     REPLACEB have been added, to improve support for the ISO     standard format. Also, a cell range selection or a     selected group of shapes (images) can be now exported in     PNG or JPG format.

  - In Impress, the default slide size has been switched to     16:9, to support the most recent form factors of screens     and projectors. As a consequence, 10 new Impress     templates have been added, and a couple of old templates     have been updated. Changes in components :

  - The old WikiHelp has been replaced by the new Help     Online system, with attractive web pages that can also     be displayed on mobile devices. In general, LibreOffice     Help has been updated both in terms of contents and     code, with other improvements due all along the life of     the LibreOffice 6 family.

  - User dictionaries now allow automatic affixation or     compounding. This is a general spell checking     improvement in LibreOffice which can speed up work for     Writer users. Instead of manually handling several forms     of a new word in a language with rich morphology or     compounding, the Hunspell spell checker can     automatically recognize a new word with affixes or     compounds, based on a     &Atilde;&cent;&Acirc;&#128;&Acirc;&#156;Grammar     By&Atilde;&cent;&Acirc;&#128;&Acirc;&#157; model.
    Security features and changes :

  - OpenPGP keys can be used to sign ODF documents on all     desktop operating systems, with experimental support for     OpenPGP-based encryption. To enable this feature, users     will have to install the specific GPG software for their     operating systems.

  - Document classification has also been improved, and     allows multiple policies (which are now exported to     OOXML files). In Writer, marking and signing are now     supported at paragraph level. Interoperability changes :

  - OOXML interoperability has been improved in several     areas: import of SmartArt and import/export of ActiveX     controls, support of embedded text documents and     spreadsheets, export of embedded videos to PPTX, export     of cross-references to DOCX, export of MailMerge fields     to DOCX, and improvements to the PPTX filter to prevent     the creation of broken files.

  - New filters for exporting Writer documents to ePub and     importing QuarkXPress files have also been added,     together with an improved filter for importing EMF+     (Enhanced Metafile Format Plus) files as used by     Microsoft Office documents. Some improvements have also     been added to the ODF export filter, making it easier     for other ODF readers to display visuals. The full blog     entry for the 6.0 release can be found here:
    &#9;https://blog.documentfoundation.org/blog/2018/01/31/     libreoffice-6/ The full release notes can be found here:
    &#9;https://wiki.documentfoundation.org/ReleaseNotes/6.0     The libraries that LibreOffice depends on also have been     udpated to their current versions.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

LibreOffice was updated to version 5.3.5.2, bringing new features and enhancements :

Writer :

  - New 'Go to Page' dialog for quickly jumping to another     page.

  - Support for 'Table Styles'.

  - New drawing tools were added.

  - Improvements in the toolbar.

  - Borderless padding is displayed.

Calc :

  - New drawing tools were added.

  - In new installations the default setting for new     documents is now 'Enable wildcards in formulas' instead     of regular expressions.

  - Improved compatibility with ODF 1.2

Impress :

  - Images inserted via 'Photo Album' can now be linked     instead of embedded in the document.

  - When launching Impress, a Template Selector allows you     to choose a Template to start with.

  - Two new default templates: Vivid and Pencil.

  - All existing templates have been improved.

Draw :

  - New arrow endings, including Crow's foot notation's     ones.

Base :

  - Firebird has been upgraded to version 3.0.0. It is     unable to read back Firebird 2.5 data, so embedded     Firebird odb files created in LibreOffice version up to     5.2 cannot be opened with LibreOffice 5.3.

Some security issues have also been fixed :

  - CVE-2017-7870: An out-of-bounds write caused by a     heap-based buffer overflow related to the     tools::Polygon::Insert function.

  - CVE-2017-7882: An out-of-bounds write related to the     HWPFile::TagsRead function.

  - CVE-2017-8358: an out-of-bounds write caused by a     heap-based buffer overflow related to the ReadJPEG     function.

  - CVE-2016-10327: An out-of-bounds write caused by a     heap-based buffer overflow related to the     EnhWMFReader::ReadEnhWMF function.

  - CVE-2017-9433: An out-of-bounds write caused by a     heap-based buffer overflow related to the     MsWrd1Parser::readFootnoteCorrespondance function in     libmwaw.

A comprehensive list of new features and changes in this release is available at: https://wiki.documentfoundation.org/ReleaseNotes/5.3

This update contains binaries for the ports architectures only. This update was imported from the SUSE:SLE-12:Update update project.

LibreOffice was updated to version 5.3.5.2, bringing new features and enhancements: Writer :

  - New 'Go to Page' dialog for quickly jumping to another     page.

  - Support for 'Table Styles'.

  - New drawing tools were added.

  - Improvements in the toolbar.

  - Borderless padding is displayed. Calc :

  - New drawing tools were added.

  - In new installations the default setting for new     documents is now 'Enable wildcards in formulas' instead     of regular expressions.

  - Improved compatibility with ODF 1.2 Impress :

  - Images inserted via 'Photo Album' can now be linked     instead of embedded in the document.

  - When launching Impress, a Template Selector allows you     to choose a Template to start with.

  - Two new default templates: Vivid and Pencil.

  - All existing templates have been improved. Draw :

  - New arrow endings, including Crow's foot notation's     ones. Base :

  - Firebird has been upgraded to version 3.0.0. It is     unable to read back Firebird 2.5 data, so embedded     Firebird odb files created in LibreOffice version up to     5.2 cannot be opened with LibreOffice 5.3. Some security     issues have also been fixed :

  - CVE-2017-7870: An out-of-bounds write caused by a     heap-based buffer overflow related to the     tools::Polygon::Insert function.

  - CVE-2017-7882: An out-of-bounds write related to the     HWPFile::TagsRead function.

  - CVE-2017-8358: an out-of-bounds write caused by a     heap-based buffer overflow related to the ReadJPEG     function.

  - CVE-2016-10327: An out-of-bounds write caused by a     heap-based buffer overflow related to the     EnhWMFReader::ReadEnhWMF function.

  - CVE-2017-9433: An out-of-bounds write caused by a     heap-based buffer overflow related to the     MsWrd1Parser::readFootnoteCorrespondance function in     libmwaw. A comprehensive list of new features and     changes in this release is available at:
    https://wiki.documentfoundation.org/ReleaseNotes/5.3

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

new upstream release

----

Security fix for CVE-2017-9433

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2017-9433

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

LibreOffice was updated to version 5.3.3.2, bringing new features and enhancements :

Writer :

  - New 'Go to Page' dialog for quickly jumping to another     page.

  - Support for 'Table Styles'.

  - New drawing tools were added.

  - Improvements in the toolbar.

  - Borderless padding is displayed.

Calc :

  - New drawing tools were added.

  - In new installations the default setting for new     documents is now 'Enable wildcards in formulas' instead     of regular expressions.

  - Improved compatibility with ODF 1.2

Impress :

  - Images inserted via 'Photo Album' can now be linked     instead of embedded in the document.

  - When launching Impress, a Template Selector allows you     to choose a Template to start with.

  - Two new default templates: Vivid and Pencil.

  - All existing templates have been improved.

Draw :

  - New arrow endings, including Crow's foot notation's     ones.

Base :

  - Firebird has been upgraded to version 3.0.0. It is     unable to read back Firebird 2.5 data, so embedded     Firebird odb files created in LibreOffice version up to     5.2 cannot be opened with LibreOffice 5.3.

Some security issues have also been fixed :

  - CVE-2017-7870: An out-of-bounds write caused by a     heap-based buffer overflow related to the     tools::Polygon::Insert function.

  - CVE-2017-7882: An out-of-bounds write related to the     HWPFile::TagsRead function.

  - CVE-2017-8358: an out-of-bounds write caused by a     heap-based buffer overflow related to the ReadJPEG     function.

  - CVE-2016-10327: An out-of-bounds write caused by a     heap-based buffer overflow related to the     EnhWMFReader::ReadEnhWMF function.

  - CVE-2017-9433: An out-of-bounds write caused by a     heap-based buffer overflow related to the     MsWrd1Parser::readFootnoteCorrespondance function in     libmwaw.

A comprehensive list of new features and changes in this release is available at: https://wiki.documentfoundation.org/ReleaseNotes/5.3

This update was imported from the SUSE:SLE-12:Update update project.

LibreOffice was updated to version 5.3.3.2, bringing new features and enhancements: Writer :

  - New 'Go to Page' dialog for quickly jumping to another     page.

  - Support for 'Table Styles'.

  - New drawing tools were added.

  - Improvements in the toolbar.

  - Borderless padding is displayed. Calc :

  - New drawing tools were added.

  - In new installations the default setting for new     documents is now 'Enable wildcards in formulas' instead     of regular expressions.

  - Improved compatibility with ODF 1.2 Impress :

  - Images inserted via 'Photo Album' can now be linked     instead of embedded in the document.

  - When launching Impress, a Template Selector allows you     to choose a Template to start with.

  - Two new default templates: Vivid and Pencil.

  - All existing templates have been improved. Draw :

  - New arrow endings, including Crow's foot notation's     ones. Base :

  - Firebird has been upgraded to version 3.0.0. It is     unable to read back Firebird 2.5 data, so embedded     Firebird odb files created in LibreOffice version up to     5.2 cannot be opened with LibreOffice 5.3. Some security     issues have also been fixed :

  - CVE-2017-7870: An out-of-bounds write caused by a     heap-based buffer overflow related to the     tools::Polygon::Insert function.

  - CVE-2017-7882: An out-of-bounds write related to the     HWPFile::TagsRead function.

  - CVE-2017-8358: an out-of-bounds write caused by a     heap-based buffer overflow related to the ReadJPEG     function.

  - CVE-2016-10327: An out-of-bounds write caused by a     heap-based buffer overflow related to the     EnhWMFReader::ReadEnhWMF function.

  - CVE-2017-9433: An out-of-bounds write caused by a     heap-based buffer overflow related to the     MsWrd1Parser::readFootnoteCorrespondance function in     libmwaw. A comprehensive list of new features and     changes in this release is available at:
    https://wiki.documentfoundation.org/ReleaseNotes/5.3

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3319-1 advisory.

    It was discovered that libmwaw incorrectly handled certain malformed document files. If a user or     automated system were tricked into opening a specially crafted file, a remote attacker could cause libmwaw     to crash, resulting in a denial of service, or possibly execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It was discovered that a buffer overflow in libmwaw, a library to open old Mac text documents might result in the execution of arbitrary code if a malformed document is opened.

ID	Name	Product	Family	Severity
199511	RHEL 7 : libmwaw (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
131809	EulerOS 2.0 SP5 : libmwaw (EulerOS-SA-2019-2535)	Nessus	Huawei Local Security Checks	critical
109357	SUSE SLED12 / SLES12 Security Update : Recommended update for LibreOffice (SUSE-SU-2018:1076-1)	Nessus	SuSE Local Security Checks	critical
103284	openSUSE Security Update : libreoffice (openSUSE-2017-1048)	Nessus	SuSE Local Security Checks	critical
102911	SUSE SLED12 Security Update : libreoffice (SUSE-SU-2017:2315-1)	Nessus	SuSE Local Security Checks	critical
101989	Fedora 25 : libmwaw (2017-2d8a1226d1)	Nessus	Fedora Local Security Checks	critical
101605	Fedora 26 : libmwaw (2017-3229e88ea3)	Nessus	Fedora Local Security Checks	critical
101517	openSUSE Security Update : libreoffice (openSUSE-2017-807)	Nessus	SuSE Local Security Checks	critical
101353	SUSE SLED12 Security Update : libreoffice (SUSE-SU-2017:1821-1)	Nessus	SuSE Local Security Checks	critical
100836	Ubuntu 14.04 LTS / 16.04 LTS : libmwaw vulnerability (USN-3319-1)	Nessus	Ubuntu Local Security Checks	critical
100726	Debian DSA-3875-1 : libmwaw - security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2017-9433

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical