Описание
LibreOffice converts CFF fonts to Type 1 when it subsets a font, which happens when a document is exported to PDF, and CFF fonts may be embedded in documents. A stack buffer overflow existed in that conversion. The converted operators were written into a fixed size buffer with no check that they still fit, so a glyph emitting many operators wrote past the end of the buffer. In fixed versions the remaining capacity is tracked and the conversion stops when it is used up.
A flaw was found in LibreOffice. When a user exports a document with crafted embedded fonts to PDF, a stack-based buffer overflow can occur during the conversion of CFF fonts to Type 1 fonts due to improper bounds checking. This issue can cause memory corruption, resulting in an application crash.
Отчет
To exploit this issue, an attacker needs to convince a user to export a specially crafted document to PDF. This flaw can cause memory corruption, resulting in an application crash. However, the possibility of arbitrary code execution is not discarded. For these reasons, this vulnerability has been rated with a moderate severity. Default Red Hat Enterprise Linux security features, including SELinux enforcement, Address Space Layout Randomization (ASLR) and NX (No-Execute) stack protection, significantly increase the difficulty of achieving arbitrary code execution, limiting the impact of this vulnerability.
Меры по смягчению последствий
Do not export documents from unknown or untrusted sources to PDF with LibreOffice.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | libreoffice | Out of support scope | ||
| Red Hat Enterprise Linux 7 | libreoffice | Affected | ||
| Red Hat Enterprise Linux 8 | flute | Fixed | RHSA-2026:88164 | 22.10.2026 |
| Red Hat Enterprise Linux 8 | libbase | Fixed | RHSA-2026:88164 | 22.10.2026 |
| Red Hat Enterprise Linux 8 | libfonts | Fixed | RHSA-2026:88164 | 22.10.2026 |
| Red Hat Enterprise Linux 8 | libformula | Fixed | RHSA-2026:88164 | 22.10.2026 |
| Red Hat Enterprise Linux 8 | liblayout | Fixed | RHSA-2026:88164 | 22.10.2026 |
| Red Hat Enterprise Linux 8 | libloader | Fixed | RHSA-2026:88164 | 22.10.2026 |
| Red Hat Enterprise Linux 8 | libreoffice | Fixed | RHSA-2026:88164 | 22.10.2026 |
| Red Hat Enterprise Linux 8 | librepository | Fixed | RHSA-2026:88164 | 22.10.2026 |
Показывать по
Дополнительная информация
Статус:
7.3 High
CVSS3
Связанные уязвимости
LibreOffice converts CFF fonts to Type 1 when it subsets a font, which happens when a document is exported to PDF, and CFF fonts may be embedded in documents. A stack buffer overflow existed in that conversion. The converted operators were written into a fixed size buffer with no check that they still fit, so a glyph emitting many operators wrote past the end of the buffer. In fixed versions the remaining capacity is tracked and the conversion stops when it is used up.
LibreOffice converts CFF fonts to Type 1 when it subsets a font, which happens when a document is exported to PDF, and CFF fonts may be embedded in documents. A stack buffer overflow existed in that conversion. The converted operators were written into a fixed size buffer with no check that they still fit, so a glyph emitting many operators wrote past the end of the buffer. In fixed versions the remaining capacity is tracked and the conversion stops when it is used up.
LibreOffice converts CFF fonts to Type 1 when it subsets a font, which ...
LibreOffice converts CFF fonts to Type 1 when it subsets a font, which happens when a document is exported to PDF, and CFF fonts may be embedded in documents. A stack buffer overflow existed in that conversion. The converted operators were written into a fixed size buffer with no check that they still fit, so a glyph emitting many operators wrote past the end of the buffer. In fixed versions the remaining capacity is tracked and the conversion stops when it is used up.
Important: flute, libbase, libfonts, libformula, liblayout, libloader, libreoffice, librepository, libserializer, pentaho-libxml, pentaho-reporting-flow-engine, and sac security, bug fix, and enhancement update
7.3 High
CVSS3