Veracode Vulnerability DatabaseVERACODE:25005XML External Entity Expansion
0.004 Low
EPSS
Percentile
74.8%
openoffice.org is vulnerable to XML External Entity expansion. If OpenOffice.org were to open a specially-crafted file (such as an OpenDocument Format or OpenDocument Presentation file), it could possibly allow a remote attacker to obtain a copy of an arbitrary local file that the user running OpenOffice.org had access to. A bug in the way Raptor handled external entities could cause OpenOffice.org to crash or, possibly, execute arbitrary code with the privileges of the user running OpenOffice.org.
References
blog.documentfoundation.org/2012/03/22/tdf-announces-libreoffice-3-4-6/
librdf.org/raptor/RELEASE.html#rel2_0_7
lists.fedoraproject.org/pipermail/package-announce/2012-April/077708.html
lists.fedoraproject.org/pipermail/package-announce/2012-April/078242.html
rhn.redhat.com/errata/RHSA-2012-0410.html
rhn.redhat.com/errata/RHSA-2012-0411.html
secunia.com/advisories/48479
secunia.com/advisories/48493
secunia.com/advisories/48494
secunia.com/advisories/48526
secunia.com/advisories/48529
secunia.com/advisories/48542
secunia.com/advisories/48649
secunia.com/advisories/50692
secunia.com/advisories/60799
security.gentoo.org/glsa/glsa-201209-05.xml
vsecurity.com/resources/advisory/20120324-1/
www.debian.org/security/2012/dsa-2438
www.gentoo.org/security/en/glsa/glsa-201408-19.xml
www.libreoffice.org/advisories/CVE-2012-0037/
www.mandriva.com/security/advisories?name=MDVSA-2012:061
www.mandriva.com/security/advisories?name=MDVSA-2012:062
www.mandriva.com/security/advisories?name=MDVSA-2012:063
www.openoffice.org/security/cves/CVE-2012-0037.html
www.openwall.com/lists/oss-security/2012/03/27/4
www.osvdb.org/80307
www.securityfocus.com/bid/52681
www.securitytracker.com/id?1026837
access.redhat.com/errata/RHSA-2012:0411
access.redhat.com/security/updates/classification/#important
exchange.xforce.ibmcloud.com/vulnerabilities/74235
github.com/dajobe/raptor/commit/a676f235309a59d4aa78eeffd2574ae5d341fcb0
lists.apache.org/thread.html/re0504f08000df786e51795940501e81a5d0ae981ecca68141e87ece0%40%3Ccommits.openoffice.apache.org%3E
Related
