WP1StylesListener.cpp, WP5StylesListener.cpp, and WP42StylesListener.cpp in libwpd 0.10.1 mishandle iterators, which allows remote attacker…
WP1StylesListener.cpp, WP5StylesListener.cpp, and WP42StylesListener.cpp in libwpd 0.10.1 mishandle iterators, which allows remote attackers to cause a denial of service (heap-based buffer over-read in the WPXTableList class in WPXTable.cpp). This vulnerability can be triggered in LibreOffice before 5.3.7. It may lead to suffering a remote attack against a LibreOffice application.
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
https://cwe.mitre.org/data/definitions/122.html →Open in CWE collection →The product reads data past the end, or before the beginning, of the intended buffer.
https://cwe.mitre.org/data/definitions/125.html →Open in CWE collection →This attack forces an integer variable to go out of range. The integer variable is often used as an offset such as size of memory allocation or similarly. The attacker would typically control the value of such variable and try to get it out of range. For instance the integer in question is incremented past the maximum possible value, it may wrap to become a very small, or negative number, therefore providing a very incorrect value which can lead to unexpected behavior. At worst the attacker can execute arbitrary code.
https://capec.mitre.org/data/definitions/92.html →Open in CAPEC collection →An adversary attacks a target by providing input that causes an application to read beyond the boundary of a defined buffer. This typically occurs when a value influencing where to start or stop reading is set to reflect positions outside of the valid memory location of the buffer. This type of attack may result in exposure of sensitive information, a system crash, or arbitrary code execution.
https://capec.mitre.org/data/definitions/540.html →Open in CAPEC collection →| Product | Vendor | Status |
|---|---|---|
| libwpd | Tracked | |
| libwpd | Tracked | |
| libwpd | Tracked | |
| libwpd | Tracked | |
| libwpd | Tracked | |
| libwpd | Tracked | |
| libwpd | Tracked | |
| libwpd | Tracked | |
| libwpd | Tracked | |
| libwpd | Tracked | |
| libwpd | Tracked | |
| libwpd | Tracked | |
| libwpd | Tracked | |
| libwpd | Tracked | |
| libwpd | Tracked | |
| libwpd | Tracked | |
| libwpd | Tracked | |
| libwpd | Tracked | |
| libwpd | Tracked | |
| libwpd | Tracked |