CVE-2012-1149
published 2012-06-21CVE-2012-1149: Integer overflow in the vclmi.dll module in OpenOffice.org (OOo) 3.3, 3.4 Beta, and possibly earlier, and LibreOffice before 3.5.3, allows remote attackers to…
PriorityP344high7.5CVSS 2.0
AVNACLAuNCPIPAP
EPSS
13.73%
96.1th percentile
Integer overflow in the vclmi.dll module in OpenOffice.org (OOo) 3.3, 3.4 Beta, and possibly earlier, and LibreOffice before 3.5.3, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted embedded image object, as demonstrated by a JPEG image in a .DOC file, which triggers a heap-based buffer overflow.
Affected
19 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | openoffice.org | — | — |
| apache | openoffice.org | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | libreoffice | < libreoffice 1:3.4.5-1 (bookworm) | libreoffice 1:3.4.5-1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| libreoffice | libreoffice | <= 3.5.2 | — |
| libreoffice | libreoffice | >= 0 < 1:3.4.5-1 | 1:3.4.5-1 |
| libreoffice | libreoffice | >= 0 < 1:3.4.5-1 | 1:3.4.5-1 |
| libreoffice | libreoffice | >= 0 < 1:3.4.5-1 | 1:3.4.5-1 |
| libreoffice | libreoffice | >= 0 < 1:3.4.5-1 | 1:3.4.5-1 |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_server_aus | — | — |
| redhat | enterprise_linux_server_eus | — | — |
| redhat | enterprise_linux_workstation | — | — |
CVSS provenance
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv7.5HIGH
vendor_ubuntu9.3CRITICAL
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-xqxg-hxfm-4q7f: Integer overflow in the vclmi
ghsa_unreviewed·2022-05-17
CVE-2012-1149 [HIGH] GHSA-xqxg-hxfm-4q7f: Integer overflow in the vclmi
Integer overflow in the vclmi.dll module in OpenOffice.org (OOo) 3.3, 3.4 Beta, and possibly earlier, and LibreOffice before 3.5.3, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted embedded image object, as demonstrated by a JPEG image in a .DOC file, which triggers a heap-based buffer overflow.
OSV
CVE-2012-1149: Integer overflow in the vclmi
osv·2012-06-21·CVSS 7.5
CVE-2012-1149 [HIGH] CVE-2012-1149: Integer overflow in the vclmi
Integer overflow in the vclmi.dll module in OpenOffice.org (OOo) 3.3, 3.4 Beta, and possibly earlier, and LibreOffice before 3.5.3, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted embedded image object, as demonstrated by a JPEG image in a .DOC file, which triggers a heap-based buffer overflow.
Ubuntu
OpenOffice.org vulnerabilities
vendor_ubuntu·2012-07-02·CVSS 9.3
CVE-2011-2685 [CRITICAL] OpenOffice.org vulnerabilities
Title: OpenOffice.org vulnerabilities
Summary: OpenOffice.org could be made to crash or potentially run programs as your
login if it opened a specially crafted file.
A stack-based buffer overflow was discovered in the Lotus Word Pro import
filter in OpenOffice.org. The default compiler options for affected
releases should reduce the vulnerability to a denial of service.
(CVE-2011-2685)
Huzaifa Sidhpurwala discovered that OpenOffice.org could be made to crash
if it opened a specially crafted Word document. (CVE-2011-2713)
Integer overflows were discovered in the graphics loading code of several
different image types. If a user were tricked into opening a specially
crafted file, an attacker could cause OpenOffice.org to crash or possibly
execute arbitrary code with the privileges of the
Ubuntu
LibreOffice vulnerabilities
vendor_ubuntu·2012-07-02·CVSS 7.5
CVE-2012-1149 [HIGH] LibreOffice vulnerabilities
Title: LibreOffice vulnerabilities
Summary: LibreOffice could be made to crash or potentially run programs as your
login if it opened a specially crafted file.
Integer overflows were discovered in the graphics loading code of several
different image types. If a user were tricked into opening a specially
crafted file, an attacker could cause LibreOffice to crash or possibly
execute arbitrary code with the privileges of the user invoking the
program. (CVE-2012-1149)
Sven Jacobi discovered an integer overflow when processing Escher graphics
records. If a user were tricked into opening a specially crafted PowerPoint
file, an attacker could cause LibreOffice to crash or possibly execute
arbitrary code with the privileges of the user invoking the program.
(CVE-2012-2334)
Instructions: After
Red Hat
libreoffice: Integer overflows, leading to heap-buffer overflows in JPEG, PNG and BMP reader implementations
vendor_redhat·2012-05-16·CVSS 7.5
CVE-2012-1149 [HIGH] CWE-190 libreoffice: Integer overflows, leading to heap-buffer overflows in JPEG, PNG and BMP reader implementations
libreoffice: Integer overflows, leading to heap-buffer overflows in JPEG, PNG and BMP reader implementations
Integer overflow in the vclmi.dll module in OpenOffice.org (OOo) 3.3, 3.4 Beta, and possibly earlier, and LibreOffice before 3.5.3, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted embedded image object, as demonstrated by a JPEG image in a .DOC file, which triggers a heap-based buffer overflow.
Debian
CVE-2012-1149: libreoffice - Integer overflow in the vclmi.dll module in OpenOffice.org (OOo) 3.3, 3.4 Beta, ...
vendor_debian·2012·CVSS 7.5
CVE-2012-1149 [HIGH] CVE-2012-1149: libreoffice - Integer overflow in the vclmi.dll module in OpenOffice.org (OOo) 3.3, 3.4 Beta, ...
Integer overflow in the vclmi.dll module in OpenOffice.org (OOo) 3.3, 3.4 Beta, and possibly earlier, and LibreOffice before 3.5.3, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted embedded image object, as demonstrated by a JPEG image in a .DOC file, which triggers a heap-based buffer overflow.
Scope: local
bookworm: resolved (fixed in 1:3.4.5-1)
bullseye: resolved (fixed in 1:3.4.5-1)
forky: resolved (fixed in 1:3.4.5-1)
sid: resolved (fixed in 1:3.4.5-1)
trixie: resolved (fixed in 1:3.4.5-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2012-1149 openoffice.org, libreoffice: Integer overflows, leading to heap-buffer overflows in JPEG, PNG and BMP reader implementations [fedora-all]
bugzilla·2012-05-16·CVSS 7.5
CVE-2012-1149 [HIGH] CVE-2012-1149 openoffice.org, libreoffice: Integer overflows, leading to heap-buffer overflows in JPEG, PNG and BMP reader implementations [fedora-all]
CVE-2012-1149 openoffice.org, libreoffice: Integer overflows, leading to heap-buffer overflows in JPEG, PNG and BMP reader implementations [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected Fedora
versions.
For comments that are specific to the vulnerability please use bugs filed
against "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please include this bug ID and the
bug IDs of this bug's parent bugs filed against the "Security Response"
product (the top-level CVE bugs). Please mention the CVE IDs being fixed
in the RPM changelog when available.
Bodhi update
Bugzilla
CVE-2012-1149 openoffice.org, libreoffice: Integer overflows, leading to heap-buffer overflows in JPEG, PNG and BMP reader implementations
bugzilla·2012-05-15·CVSS 7.5
CVE-2012-1149 [HIGH] CVE-2012-1149 openoffice.org, libreoffice: Integer overflows, leading to heap-buffer overflows in JPEG, PNG and BMP reader implementations
CVE-2012-1149 openoffice.org, libreoffice: Integer overflows, leading to heap-buffer overflows in JPEG, PNG and BMP reader implementations
Multiple integer overflows, leading to heap-based buffer overflows were found in the way JPEG, PNG and BMP image file reader implementations of the LibreOffice and OpenOffice.org application suites performed scanning / loading of JPEG, PNG and BMP image files. A remote attacker could provide a specially-crafted JPEG, PNG or BMP image file, which once opened by a victim in an application from the LibreOffice or OpenOffice.org application suite would lead to that application crash, or, potentially arbitrary code execution with the privileges of the user running the application.
Upstream patches:
[1] http://cgit.freedesktop.org/libreoffice/core/commit/?i
http://archives.neohapsis.com/archives/bugtraq/2012-05/0089.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2012-June/082168.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2012-May/081319.htmlhttp://rhn.redhat.com/errata/RHSA-2012-0705.htmlhttp://secunia.com/advisories/46992http://secunia.com/advisories/47244http://secunia.com/advisories/49140http://secunia.com/advisories/49373http://secunia.com/advisories/49392http://secunia.com/advisories/50692http://secunia.com/advisories/60799http://security.gentoo.org/glsa/glsa-201209-05.xmlhttp://securitytracker.com/id?1027068http://www.debian.org/security/2012/dsa-2473http://www.debian.org/security/2012/dsa-2487http://www.gentoo.org/security/en/glsa/glsa-201408-19.xmlhttp://www.libreoffice.org/advisories/cve-2012-1149/http://www.mandriva.com/security/advisories?name=MDVSA-2012:090http://www.mandriva.com/security/advisories?name=MDVSA-2012:091http://www.openoffice.org/security/cves/CVE-2012-1149.htmlhttp://www.osvdb.org/81988http://www.securityfocus.com/bid/53570https://exchange.xforce.ibmcloud.com/vulnerabilities/75692http://archives.neohapsis.com/archives/bugtraq/2012-05/0089.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2012-June/082168.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2012-May/081319.htmlhttp://rhn.redhat.com/errata/RHSA-2012-0705.htmlhttp://secunia.com/advisories/46992http://secunia.com/advisories/47244http://secunia.com/advisories/49140http://secunia.com/advisories/49373http://secunia.com/advisories/49392http://secunia.com/advisories/50692http://secunia.com/advisories/60799http://security.gentoo.org/glsa/glsa-201209-05.xmlhttp://securitytracker.com/id?1027068http://www.debian.org/security/2012/dsa-2473http://www.debian.org/security/2012/dsa-2487http://www.gentoo.org/security/en/glsa/glsa-201408-19.xmlhttp://www.libreoffice.org/advisories/cve-2012-1149/http://www.mandriva.com/security/advisories?name=MDVSA-2012:090http://www.mandriva.com/security/advisories?name=MDVSA-2012:091http://www.openoffice.org/security/cves/CVE-2012-1149.htmlhttp://www.osvdb.org/81988http://www.securityfocus.com/bid/53570https://exchange.xforce.ibmcloud.com/vulnerabilities/75692
2012-06-21
Published