Описание
LibreOffice can import presentations in the legacy binary PPT format. A stack buffer overflow existed when importing a colour-replacement record. Two fixed-size colour tables were filled from the file, but the write position was not reset between the two passes over the record, so a file whose combined colour counts exceeded the table size wrote past the end of the tables on the stack. In fixed versions the unused second pass is no longer read into those tables.
A flaw was found in LibreOffice. This vulnerability, a stack buffer overflow, occurs when processing specially crafted legacy PowerPoint (PPT) files. An attacker could exploit this by convincing a user to open a malicious document, which may lead to a denial of service (DoS) due to the application crashing. This primarily affects desktop users who handle untrusted files.
Отчет
This Moderate impact denial of service vulnerability in LibreOffice is due to a stack buffer overflow when parsing specially crafted legacy PowerPoint (PPT) files. Successful exploitation requires user interaction, as an attacker must persuade a user to open a malicious document. The flaw primarily affects desktop users who process untrusted files.
Меры по смягчению последствий
Users should exercise caution when opening untrusted or suspicious legacy PowerPoint (PPT) files. Avoid opening documents from unknown sources to prevent potential denial of service attacks. If possible, process untrusted documents in a sandboxed environment.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | libreoffice | Out of support scope | ||
| Red Hat Enterprise Linux 7 | libreoffice | Out of support scope | ||
| Red Hat Enterprise Linux 8 | libreoffice | Fix deferred | ||
| Red Hat Enterprise Linux 9 | libreoffice | Fix deferred |
Показывать по
Дополнительная информация
Статус:
5.5 Medium
CVSS3
Связанные уязвимости
LibreOffice can import presentations in the legacy binary PPT format. A stack buffer overflow existed when importing a colour-replacement record. Two fixed-size colour tables were filled from the file, but the write position was not reset between the two passes over the record, so a file whose combined colour counts exceeded the table size wrote past the end of the tables on the stack. In fixed versions the unused second pass is no longer read into those tables.
LibreOffice can import presentations in the legacy binary PPT format. A stack buffer overflow existed when importing a colour-replacement record. Two fixed-size colour tables were filled from the file, but the write position was not reset between the two passes over the record, so a file whose combined colour counts exceeded the table size wrote past the end of the tables on the stack. In fixed versions the unused second pass is no longer read into those tables.
LibreOffice can import presentations in the legacy binary PPT format. ...
LibreOffice can import presentations in the legacy binary PPT format. A stack buffer overflow existed when importing a colour-replacement record. Two fixed-size colour tables were filled from the file, but the write position was not reset between the two passes over the record, so a file whose combined colour counts exceeded the table size wrote past the end of the tables on the stack. In fixed versions the unused second pass is no longer read into those tables.
Уязвимость пакета офисных программ LibreOffice, связанная с переполнением буфера в стеке, позволяющая нарушителю вызвать отказ в обслуживании
5.5 Medium
CVSS3