Vulnerability Description
The WPXContentListener::_closeTableRow function in WPXContentListener.cpp in libwpd 0.8.8, as used by OpenOffice.org (OOo) before 3.4, allows remote attackers to execute arbitrary code via a crafted Wordperfect .WPD document that causes a negative array index to be used. NOTE: some sources report this issue as an integer overflow.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Redhat | Enterprise Linux Optional Productivity Applications | All versions |
| Redhat | Enterprise Linux Desktop | 5.0 |
| Apache | Openoffice.Org | <= 3.4 |
| Libwpd | Libwpd | 0.8.8 |
Related Weaknesses (CWE)
References
- http://archives.neohapsis.com/archives/bugtraq/2012-05/0090.html
- http://packetstormsecurity.org/files/112862/libwpd-WPXContentListener-_closeTablExploitThird Party AdvisoryVDB Entry
- http://rhn.redhat.com/errata/RHSA-2012-1043.htmlThird Party Advisory
- http://secunia.com/advisories/46992Vendor Advisory
- http://secunia.com/advisories/60799Third Party AdvisoryVDB Entry
- http://www.gentoo.org/security/en/glsa/glsa-201408-19.xml
- http://www.openoffice.org/security/cves/CVE-2012-2149.htmlVendor Advisory
- http://www.securityfocus.com/bid/53570Third Party AdvisoryVDB Entry
- http://www.securitytracker.com/id?1027069Third Party AdvisoryVDB Entry
- https://www.sec-consult.com/files/20120518-0_openoffice_memory_overwrite.txtExploit
- http://archives.neohapsis.com/archives/bugtraq/2012-05/0090.html
- http://packetstormsecurity.org/files/112862/libwpd-WPXContentListener-_closeTablExploitThird Party AdvisoryVDB Entry
- http://rhn.redhat.com/errata/RHSA-2012-1043.htmlThird Party Advisory
- http://secunia.com/advisories/46992Vendor Advisory
- http://secunia.com/advisories/60799Third Party AdvisoryVDB Entry
FAQ
What is CVE-2012-2149?
CVE-2012-2149 is a vulnerability with a CVSS score of 7.5 (HIGH). The WPXContentListener::_closeTableRow function in WPXContentListener.cpp in libwpd 0.8.8, as used by OpenOffice.org (OOo) before 3.4, allows remote attackers to execute arbitrary code via a crafted W...
How severe is CVE-2012-2149?
CVE-2012-2149 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2012-2149?
Check the references section above for vendor advisories and patch information. Affected products include: Redhat Enterprise Linux Optional Productivity Applications, Redhat Enterprise Linux Desktop, Apache Openoffice.Org, Libwpd Libwpd.