Описание
LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing a stream object. The length of the stream was taken from the object's own dictionary and was not checked against the number of bytes actually present, so copying the stream read and wrote past the end of the buffer holding it. In fixed versions the declared length is clamped to the bytes actually read.
A flaw was found in LibreOffice. When a user imports a specially crafted PDF document with LibreOffice Draw, a heap-based buffer overflow can occur due to improper validation of the stream length. This issue can cause memory corruption, resulting in an application crash.
Отчет
To exploit this issue, an attacker needs to convince a user to import a specially crafted PDF document. This flaw can cause memory corruption, resulting in an application crash. However, the possibility of arbitrary code execution is not discarded. For these reasons, this vulnerability has been rated with a moderate severity. Default Red Hat Enterprise Linux security features, including SELinux enforcement, Address Space Layout Randomization (ASLR) and NX (No-Execute) stack protection, significantly increase the difficulty of achieving arbitrary code execution, limiting the impact of this vulnerability.
Меры по смягчению последствий
Do not import PDF documents from unknown or untrusted sources with LibreOffice Draw.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | libreoffice | Out of support scope | ||
| Red Hat Enterprise Linux 7 | libreoffice | Affected | ||
| Red Hat Enterprise Linux 8 | libreoffice | Affected | ||
| Red Hat Enterprise Linux 9 | libreoffice | Fixed | RHSA-2026:82013 | 13.10.2026 |
Показывать по
Дополнительная информация
Статус:
7.3 High
CVSS3
Связанные уязвимости
LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing a stream object. The length of the stream was taken from the object's own dictionary and was not checked against the number of bytes actually present, so copying the stream read and wrote past the end of the buffer holding it. In fixed versions the declared length is clamped to the bytes actually read.
LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing a stream object. The length of the stream was taken from the object's own dictionary and was not checked against the number of bytes actually present, so copying the stream read and wrote past the end of the buffer holding it. In fixed versions the declared length is clamped to the bytes actually read.
LibreOffice Draw can import PDF documents. A heap buffer overflow exis ...
LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing a stream object. The length of the stream was taken from the object's own dictionary and was not checked against the number of bytes actually present, so copying the stream read and wrote past the end of the buffer holding it. In fixed versions the declared length is clamped to the bytes actually read.
7.3 High
CVSS3