CVE-2012-0037 Redland Raptor (aka libraptor) before 2.0.7, as used by OpenOffice 3.3 and 3.4 Beta, LibreOffice before 3.4.6 and 3.5.x before 3.5.1, and other products, allows user-assisted remote attackers to read....
MediumCVSS 6.5
EPSS 13.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Redland Raptor (aka libraptor) before 2.0.7, as used by OpenOffice 3.3 and 3.4 Beta, LibreOffice before 3.4.6 and 3.5.x before 3.5.1, and other products, allows user-assisted remote attackers to read arbitrary files via a crafted XML external entity (XXE) declaration and reference in an RDF document.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| librdf raptor | < 2.0.7 | 2.0.7 |
| libreoffice | < 3.4.6 | 3.4.6 |
| libreoffice | = 3.5.0 | No fix listed |
| apache openoffice | = 3.3.0 | No fix listed |
| apache openoffice | = 3.4.0-beta | No fix listed |
| fedoraproject fedora | = 16 | No fix listed |
| fedoraproject fedora | = 17 | No fix listed |
| redhat gluster storage server for on-premise | = 2.0 | No fix listed |
| redhat storage | = 2.0 | No fix listed |
| redhat storage for public cloud | = 2.0 | No fix listed |
| redhat enterprise linux desktop | = 5.0 | No fix listed |
| redhat enterprise linux desktop | = 6.0 | No fix listed |
| redhat enterprise linux eus | = 6.2 | No fix listed |
| redhat enterprise linux server | = 5.0 | No fix listed |
| redhat enterprise linux server | = 6.0 | No fix listed |
| redhat enterprise linux server aus | = 6.2 | No fix listed |
| redhat enterprise linux workstation | = 5.0 | No fix listed |
| redhat enterprise linux workstation | = 6.0 | No fix listed |
| debian linux | = 6.0 | No fix listed |
References
- blog.documentfoundation.org release-notes
- librdf.org release-notes
- FEDORA-2012-4629 mailing-list vendor-advisory
- FEDORA-2012-4663 mailing-list vendor-advisory
- RHSA-2012:0410 third-party-advisory vendor-advisory
- RHSA-2012:0411 third-party-advisory vendor-advisory
- 48479 broken-link third-party-advisory vendor-advisory
- 48493 broken-link third-party-advisory vendor-advisory
- 48494 broken-link third-party-advisory
- 48526 broken-link third-party-advisory vendor-advisory
- 48529 broken-link third-party-advisory vendor-advisory
- 48542 broken-link third-party-advisory vendor-advisory
- 48649 broken-link third-party-advisory
- 50692 broken-link third-party-advisory
- 60799 broken-link third-party-advisory
- GLSA-201209-05 third-party-advisory vendor-advisory
- vsecurity.com broken-link
- DSA-2438 third-party-advisory vendor-advisory
- GLSA-201408-19 third-party-advisory vendor-advisory
- www.libreoffice.org vendor-advisory
- MDVSA-2012:061 broken-link vendor-advisory
- MDVSA-2012:062 broken-link vendor-advisory
- MDVSA-2012:063 broken-link vendor-advisory
- www.openoffice.org mitigation patch
- [oss-security] 20120427 Fwd: CVE-2012-0037: libraptor - XXE in RDF/XML File Interpretation (Multiple office products affected) exploit mailing-list
- 80307 broken-link vdb-entry
- 52681 broken-link third-party-advisory vdb-entry
- 1026837 broken-link third-party-advisory vdb-entry
- openoffice-xml-info-disclosure(74235) third-party-advisory vdb-entry
- github.com patch
- [openoffice-commits] 20200305 svn commit: r1874832 - in /openoffice/ooo-site/trunk/content: download/checksums.html download/globalvars.js download/test/globalvars.js security/cves/CVE-2012-0037.html security/cves/CVE-2013-1571.html mailing-list patch