Vulnerability CVE-2012-0037


Published: 2012-06-16   Modified: 2012-06-17

Description:
Redland Raptor (aka libraptor) before 2.0.7, as used by OpenOffice 3.3 and 3.4 Beta, LibreOffice before 3.4.6 and 3.5.x before 3.5.1, and other products, allows user-assisted remote attackers to read arbitrary files via a crafted XML external entity (XXE) declaration and reference in an RDF document.

See advisories in our WLB2 database:
Topic
Author
Date
High
libraptor XXE in RDF/XML File Interpretation
tmorgan
25.03.2012

Type:

CWE-200

(Information Exposure)

CVSS2 => (AV:N/AC:M/Au:N/C:P/I:N/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
4.3/10
2.9/10
8.6/10
Exploit range
Attack complexity
Authentication
Remote
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
None
None
Affected software
SUN -> Openoffice.org 
Redland -> Libraptor 
Libreoffice -> Libreoffice 
Apache -> Openoffice.org 

 References:
https://github.com/dajobe/raptor/commit/a676f235309a59d4aa78eeffd2574ae5d341fcb0
http://xforce.iss.net/xforce/xfdb/74235
http://www.securitytracker.com/id?1026837
http://www.securityfocus.com/bid/52681
http://www.osvdb.org/80307
http://www.openwall.com/lists/oss-security/2012/03/27/4
http://www.openoffice.org/security/cves/CVE-2012-0037.html
http://www.mandriva.com/security/advisories?name=MDVSA-2012:063
http://www.mandriva.com/security/advisories?name=MDVSA-2012:062
http://www.mandriva.com/security/advisories?name=MDVSA-2012:061
http://www.libreoffice.org/advisories/CVE-2012-0037/
http://www.gentoo.org/security/en/glsa/glsa-201408-19.xml
http://www.debian.org/security/2012/dsa-2438
http://vsecurity.com/resources/advisory/20120324-1/
http://security.gentoo.org/glsa/glsa-201209-05.xml
http://secunia.com/advisories/60799
http://secunia.com/advisories/50692
http://secunia.com/advisories/48649
http://secunia.com/advisories/48542
http://secunia.com/advisories/48529
http://secunia.com/advisories/48526
http://secunia.com/advisories/48494
http://secunia.com/advisories/48493
http://secunia.com/advisories/48479
http://rhn.redhat.com/errata/RHSA-2012-0411.html
http://rhn.redhat.com/errata/RHSA-2012-0410.html
http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078242.html
http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077708.html
http://librdf.org/raptor/RELEASE.html#rel2_0_7
http://blog.documentfoundation.org/2012/03/22/tdf-announces-libreoffice-3-4-6/

Copyright 2024, cxsecurity.com

 

Back to Top