National Cyber Awareness System

Vulnerability Summary for CVE-2012-0037

Overview

Redland Raptor (aka libraptor) before 2.0.7, as used by OpenOffice 3.3 and 3.4 Beta, LibreOffice before 3.4.6 and 3.5.x before 3.5.1, and other products, allows user-assisted remote attackers to read arbitrary files via a crafted XML external entity (XXE) declaration and reference in an RDF document.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: CONFIRM

Name: https://github.com/dajobe/raptor/commit/a676f235309a59d4aa78eeffd2574ae5d341fcb0

Type: Patch Information; Exploit

Hyperlink:https://github.com/dajobe/raptor/commit/a676f235309a59d4aa78eeffd2574ae5d341fcb0

External Source: XF

Name: openoffice-xml-info-disclosure(74235)

Hyperlink:http://xforce.iss.net/xforce/xfdb/74235

External Source: SECTRACK

Name: 1026837

Hyperlink:http://www.securitytracker.com/id?1026837

External Source: BID

Name: 52681

Hyperlink:http://www.securityfocus.com/bid/52681

External Source: OSVDB

Name: 80307

Hyperlink:http://www.osvdb.org/80307

External Source: MLIST

Name: [oss-security] 20120427 Fwd: CVE-2012-0037: libraptor - XXE in RDF/XML File Interpretation (Multiple office products affected)

Hyperlink:http://www.openwall.com/lists/oss-security/2012/03/27/4

External Source: MANDRIVA

Name: MDVSA-2012:063

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2012:063

External Source: MANDRIVA

Name: MDVSA-2012:062

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2012:062

External Source: MANDRIVA

Name: MDVSA-2012:061

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2012:061

External Source: CONFIRM

Name: http://www.libreoffice.org/advisories/CVE-2012-0037/

Type: Advisory

Hyperlink:http://www.libreoffice.org/advisories/CVE-2012-0037/

External Source: DEBIAN

Name: DSA-2438

Hyperlink:http://www.debian.org/security/2012/dsa-2438

External Source: MISC

Name: http://vsecurity.com/resources/advisory/20120324-1/

Hyperlink:http://vsecurity.com/resources/advisory/20120324-1/

External Source: GENTOO

Name: GLSA-201209-05

Hyperlink:http://security.gentoo.org/glsa/glsa-201209-05.xml

External Source: SECUNIA

Name: 50692

Hyperlink:http://secunia.com/advisories/50692

External Source: SECUNIA

Name: 48649

Hyperlink:http://secunia.com/advisories/48649

External Source: SECUNIA

Name: 48542

Type: Advisory

Hyperlink:http://secunia.com/advisories/48542

External Source: SECUNIA

Name: 48529

Type: Advisory

Hyperlink:http://secunia.com/advisories/48529

External Source: SECUNIA

Name: 48526

Type: Advisory

Hyperlink:http://secunia.com/advisories/48526

External Source: SECUNIA

Name: 48494

Hyperlink:http://secunia.com/advisories/48494

External Source: SECUNIA

Name: 48493

Type: Advisory

Hyperlink:http://secunia.com/advisories/48493

External Source: SECUNIA

Name: 48479

Type: Advisory

Hyperlink:http://secunia.com/advisories/48479

External Source: REDHAT

Name: RHSA-2012:0411

Hyperlink:http://rhn.redhat.com/errata/RHSA-2012-0411.html

External Source: REDHAT

Name: RHSA-2012:0410

Hyperlink:http://rhn.redhat.com/errata/RHSA-2012-0410.html

External Source: FEDORA

Name: FEDORA-2012-4663

Hyperlink:http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078242.html

External Source: FEDORA

Name: FEDORA-2012-4629

Hyperlink:http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077708.html

External Source: CONFIRM

Name: http://librdf.org/raptor/RELEASE.html#rel2_0_7

Hyperlink:http://librdf.org/raptor/RELEASE.html#rel2_0_7

External Source: CONFIRM

Name: http://blog.documentfoundation.org/2012/03/22/tdf-announces-libreoffice-3-4-6/

Hyperlink:http://blog.documentfoundation.org/2012/03/22/tdf-announces-libreoffice-3-4-6/