ID CVE-2017-7882
Summary LibreOffice before 2017-03-14 has an out-of-bounds write related to the HWPFile::TagsRead function in hwpfilter/source/hwpfile.cxx.
References
Vulnerable Configurations
  • LibreOffice 5.2.6
    cpe:2.3:a:libreoffice:libreoffice:5.2.6
CVSS
Base: 7.5 (as of 21-04-2017 - 11:07)
Impact:
Exploitability:
CWE CWE-787
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
nessus via4
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2017-2315-1.NASL
    description LibreOffice was updated to version 5.3.5.2, bringing new features and enhancements: Writer : - New 'Go to Page' dialog for quickly jumping to another page. - Support for 'Table Styles'. - New drawing tools were added. - Improvements in the toolbar. - Borderless padding is displayed. Calc : - New drawing tools were added. - In new installations the default setting for new documents is now 'Enable wildcards in formulas' instead of regular expressions. - Improved compatibility with ODF 1.2 Impress : - Images inserted via 'Photo Album' can now be linked instead of embedded in the document. - When launching Impress, a Template Selector allows you to choose a Template to start with. - Two new default templates: Vivid and Pencil. - All existing templates have been improved. Draw : - New arrow endings, including Crow's foot notation's ones. Base : - Firebird has been upgraded to version 3.0.0. It is unable to read back Firebird 2.5 data, so embedded Firebird odb files created in LibreOffice version up to 5.2 cannot be opened with LibreOffice 5.3. Some security issues have also been fixed : - CVE-2017-7870: An out-of-bounds write caused by a heap-based buffer overflow related to the tools::Polygon::Insert function. - CVE-2017-7882: An out-of-bounds write related to the HWPFile::TagsRead function. - CVE-2017-8358: an out-of-bounds write caused by a heap-based buffer overflow related to the ReadJPEG function. - CVE-2016-10327: An out-of-bounds write caused by a heap-based buffer overflow related to the EnhWMFReader::ReadEnhWMF function. - CVE-2017-9433: An out-of-bounds write caused by a heap-based buffer overflow related to the MsWrd1Parser::readFootnoteCorrespondance function in libmwaw. A comprehensive list of new features and changes in this release is available at: https://wiki.documentfoundation.org/ReleaseNotes/5.3 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2018-02-01
    modified 2018-01-31
    plugin id 102911
    published 2017-09-01
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=102911
    title SUSE SLED12 Security Update : libreoffice (SUSE-SU-2017:2315-1)
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2017-807.NASL
    description LibreOffice was updated to version 5.3.3.2, bringing new features and enhancements : Writer : - New 'Go to Page' dialog for quickly jumping to another page. - Support for 'Table Styles'. - New drawing tools were added. - Improvements in the toolbar. - Borderless padding is displayed. Calc : - New drawing tools were added. - In new installations the default setting for new documents is now 'Enable wildcards in formulas' instead of regular expressions. - Improved compatibility with ODF 1.2 Impress : - Images inserted via 'Photo Album' can now be linked instead of embedded in the document. - When launching Impress, a Template Selector allows you to choose a Template to start with. - Two new default templates: Vivid and Pencil. - All existing templates have been improved. Draw : - New arrow endings, including Crow's foot notation's ones. Base : - Firebird has been upgraded to version 3.0.0. It is unable to read back Firebird 2.5 data, so embedded Firebird odb files created in LibreOffice version up to 5.2 cannot be opened with LibreOffice 5.3. Some security issues have also been fixed : - CVE-2017-7870: An out-of-bounds write caused by a heap-based buffer overflow related to the tools::Polygon::Insert function. - CVE-2017-7882: An out-of-bounds write related to the HWPFile::TagsRead function. - CVE-2017-8358: an out-of-bounds write caused by a heap-based buffer overflow related to the ReadJPEG function. - CVE-2016-10327: An out-of-bounds write caused by a heap-based buffer overflow related to the EnhWMFReader::ReadEnhWMF function. - CVE-2017-9433: An out-of-bounds write caused by a heap-based buffer overflow related to the MsWrd1Parser::readFootnoteCorrespondance function in libmwaw. A comprehensive list of new features and changes in this release is available at: https://wiki.documentfoundation.org/ReleaseNotes/5.3 This update was imported from the SUSE:SLE-12:Update update project.
    last seen 2018-01-27
    modified 2018-01-26
    plugin id 101517
    published 2017-07-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=101517
    title openSUSE Security Update : libreoffice (openSUSE-2017-807)
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2017-1048.NASL
    description LibreOffice was updated to version 5.3.5.2, bringing new features and enhancements : Writer : - New 'Go to Page' dialog for quickly jumping to another page. - Support for 'Table Styles'. - New drawing tools were added. - Improvements in the toolbar. - Borderless padding is displayed. Calc : - New drawing tools were added. - In new installations the default setting for new documents is now 'Enable wildcards in formulas' instead of regular expressions. - Improved compatibility with ODF 1.2 Impress : - Images inserted via 'Photo Album' can now be linked instead of embedded in the document. - When launching Impress, a Template Selector allows you to choose a Template to start with. - Two new default templates: Vivid and Pencil. - All existing templates have been improved. Draw : - New arrow endings, including Crow's foot notation's ones. Base : - Firebird has been upgraded to version 3.0.0. It is unable to read back Firebird 2.5 data, so embedded Firebird odb files created in LibreOffice version up to 5.2 cannot be opened with LibreOffice 5.3. Some security issues have also been fixed : - CVE-2017-7870: An out-of-bounds write caused by a heap-based buffer overflow related to the tools::Polygon::Insert function. - CVE-2017-7882: An out-of-bounds write related to the HWPFile::TagsRead function. - CVE-2017-8358: an out-of-bounds write caused by a heap-based buffer overflow related to the ReadJPEG function. - CVE-2016-10327: An out-of-bounds write caused by a heap-based buffer overflow related to the EnhWMFReader::ReadEnhWMF function. - CVE-2017-9433: An out-of-bounds write caused by a heap-based buffer overflow related to the MsWrd1Parser::readFootnoteCorrespondance function in libmwaw. A comprehensive list of new features and changes in this release is available at: https://wiki.documentfoundation.org/ReleaseNotes/5.3 This update contains binaries for the ports architectures only. This update was imported from the SUSE:SLE-12:Update update project.
    last seen 2018-01-27
    modified 2018-01-26
    plugin id 103284
    published 2017-09-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=103284
    title openSUSE Security Update : libreoffice (openSUSE-2017-1048)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2017-1821-1.NASL
    description LibreOffice was updated to version 5.3.3.2, bringing new features and enhancements: Writer : - New 'Go to Page' dialog for quickly jumping to another page. - Support for 'Table Styles'. - New drawing tools were added. - Improvements in the toolbar. - Borderless padding is displayed. Calc : - New drawing tools were added. - In new installations the default setting for new documents is now 'Enable wildcards in formulas' instead of regular expressions. - Improved compatibility with ODF 1.2 Impress : - Images inserted via 'Photo Album' can now be linked instead of embedded in the document. - When launching Impress, a Template Selector allows you to choose a Template to start with. - Two new default templates: Vivid and Pencil. - All existing templates have been improved. Draw : - New arrow endings, including Crow's foot notation's ones. Base : - Firebird has been upgraded to version 3.0.0. It is unable to read back Firebird 2.5 data, so embedded Firebird odb files created in LibreOffice version up to 5.2 cannot be opened with LibreOffice 5.3. Some security issues have also been fixed : - CVE-2017-7870: An out-of-bounds write caused by a heap-based buffer overflow related to the tools::Polygon::Insert function. - CVE-2017-7882: An out-of-bounds write related to the HWPFile::TagsRead function. - CVE-2017-8358: an out-of-bounds write caused by a heap-based buffer overflow related to the ReadJPEG function. - CVE-2016-10327: An out-of-bounds write caused by a heap-based buffer overflow related to the EnhWMFReader::ReadEnhWMF function. - CVE-2017-9433: An out-of-bounds write caused by a heap-based buffer overflow related to the MsWrd1Parser::readFootnoteCorrespondance function in libmwaw. A comprehensive list of new features and changes in this release is available at: https://wiki.documentfoundation.org/ReleaseNotes/5.3 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2018-02-01
    modified 2018-01-31
    plugin id 101353
    published 2017-07-10
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=101353
    title SUSE SLED12 Security Update : libreoffice (SUSE-SU-2017:1821-1)
refmap via4
bid 97684
confirm http://www.libreoffice.org/about-us/security/advisories/cve-2017-7882/
misc
Last major update 21-04-2017 - 11:23
Published 15-04-2017 - 12:59
Last modified 14-11-2017 - 21:29
Back to Top