Fixed in AOO 4.1.2: CVE-2015-5212 ODF Printer Settings Vulnerability

classic Classic list List threaded Threaded
1 message Options
Reply | Threaded
Open this post in threaded view
|

Fixed in AOO 4.1.2: CVE-2015-5212 ODF Printer Settings Vulnerability

Dennis E. Hamilton-2
Republished without change.  This advisory, originally posted
on 2015-11-04, died in a moderation queue and did not reach
the list.  The [hidden email] is the official
mailing list for Apache OpenOffice security advisories, as
specified at <http://www.openoffice.org/security/alerts.html>.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


                  NOTICE: APACHE OPENOFFICE SECURITY ADVISORY

               CVE-2015-5212: ODF PRINTER SETTINGS VULNERABILITY

                        FIXED IN APACHE OPENOFFICE 4.1.2

CVE-2015-5212
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=2015-5212>
Apache OpenOffice Advisory
<https://www.openoffice.org/security/cves/CVE-2015-5212.html>

Title: Buffer Overflow Vulnerability (Printer Setup)

Version 1.0
Announced 2015-11-04

    A crafted ODF document can be used to create a buffer that is
    too small for the amount of data loaded into it, allowing an
    attacker to cause denial of service (memory corruption and
    application crash) and possible execution of arbitrary code.

Severity: Important

    There are no known exploits of this vulnerability.
    A proof-of-concept demonstration exists.

Vendor: The Apache Software Foundation

Version Affected

    All Apache OpenOffice versions 4.1.1 and older are affected.
    OpenOffice.org versions are also affected.

Mitigation

    Apache OpenOffice users are urged to download and install
    Apache OpenOffice version 4.1.2 or later.  Use of in-document
    control of printer settings is disabled in 4.1.2.

Precautions

    Users who do not upgrade to Apache OpenOffice 4.1.2 can
    disable the vulnerability directly by declining to use
    printer settings provided as part of ODF Documents:

     1. In Apache OpenOffice, select the Tools menu Options entry.
     2. On the Options Load/Save item's General sub-item, remove any
        check for "Load printer settings with the document"
     3. Click "OK"
     4. This setting will apply to all documents loaded thereafter.

Further Information

    For additional information and assistance, consult the Apache
    OpenOffice Community Forums, <https://forum.openoffice.org/>,
    or make requests to the <mailto:[hidden email]>
    public mailing list.

    The latest information on Apache OpenOffice security bulletins
    can be found at <http://www.openoffice.org/security/bulletin.html>.

Credits

    The discoverer of this vulnerability wishes to remain anonymous.
    The Apache OpenOffice security team thanks Caolán McNamara of
    Red Hat for analysis and solution.

PGP key Fingerprint 04D0 4322 979B 84DE 1077 0334 F96E 89FF D456 628A
        <https://people.apache.org/keys/committer/orcmid.asc>

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBAgAGBQJWOpaTAAoJEPluif/UVmKKN4QH/RwgWxsDjOTidJ0gA3I2MmQt
3XK6QpH0sp3y6eE3+ZBLWzeevT8hxV5FzjnBC3lrd3tIdeHgUJis8dU2BEK3zKNq
rJFRr6B7DawpzrHF7ZsZkbPnAepmeGgq9IXARwwwK7OvD4rjFfsssY5X7VN0yhDz
08aZwrgB/cYMJW4bFodCFX7K3YEuW3VnALchUTjYgWOtVf1hA2bsTo06T5NT/q0v
d+n5uYvNLmtIyE7GmAhIKUi7OSQaEUMMd4NnIkRFVRUvG93h9viFqWpAZioTANVr
sFwKQdNUDQQ4iqVgqprakYRbbtQQLX+5E5066yj7TtSkhL6Uo8JlrJnzfE4rW30=
=D7Yu
-----END PGP SIGNATURE-----