-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
CVE-2016-1513 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=2016-1513> Apache OpenOffice Advisory <https://www.openoffice.org/security/cves/CVE-2016-1513.html> Title: Memory Corruption Vulnerability (Impress Presentations) Version 3.0 Updated October 11, 2016 Updated August 30, 2016 Announced July 21, 2016 Description An OpenDocument Presentation .ODP or Presentation Template .OTP file can contain invalid presentation elements that lead to memory corruption when the document is loaded in Apache OpenOffice Impress. The defect may cause the document to appear as corrupted and OpenOffice may crash in a recovery- stuck mode. A crafted exploitation of the defect can allow an attacker to cause denial of service (memory corruption and application crash) and possible execution of arbitrary code. Impress cannot be used to directly produce documents having the CVE-2016-1513-related defect. Impress-authored .ODP and .OTP documents of an user's own that exhibit any of these characteristics are not the result of an exploit. They may be consequences of a separate Impress defect that should be reported. Severity: Medium There are no known exploits of this vulnerability. A proof-of-concept demonstration exists. Vendor: The Apache Software Foundation Versions Affected: All Apache OpenOffice versions 4.1.2 and older are affected. OpenOffice.org versions are also affected. Mitigation: Install Apache OpenOffice 4.1.3 for the latest maintenance and cumulative security fixes. Use <https://www.openoffice.org/download/>. Users of Apache OpenOffice 4.1.2 that cannot update to 4.1.3 can install the 4.1.2-patch1 Hotfix available at <http://archive.apache.org/dist/openoffice/4.1.2-patch1/hotfix.html>. A source-code patch that blocks the vulnerability has been developed and is available for developers at <https://bz.apache.org/ooo/show_bug.cgi?id=127045>. Antivirus products can detect documents attempting to exploit this vulnerability by employing Snort Signature IDs 35828-35829. Defenses and Work-Arounds: If you are unable to update, there are other precautions that can be taken. These precautions are recommended for all users of all versions of Apache OpenOffice, including the latest available. Avoid operating Apache OpenOffice (and any other personal productivity programs) under a computer account that has administrative privileges of any kind. While installation of Apache OpenOffice requires elevated privileges and user permission on platforms such as Microsoft Windows, operation of the software does not. Keeping antivirus/antimalware software current is also important. This will serve to identify and distinguish suspicious documents that involve known exploits, avoiding confusion with documents that are damaged and/or fail for other reasons. Further Information: For additional information and assistance, consult the Apache OpenOffice Community Forums, <https://forum.openoffice.org/>, or make requests to the <mailto:us...@openoffice.apache.org> public mailing list. Defects not involving suspected security vulnerabilities can be reported via <http://www.openoffice.org/qa/issue_handling/pre_submission.html>. The latest information on Apache OpenOffice security bulletins can be found at the Bulletin Archive page <http://www.openoffice.org/security/bulletin.html>. Credits: The Apache OpenOffice project acknowledges the discovery and analysis for CVE-2016-1513 by Yves Younan and Richard Johnson of Cisco Talos. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQEcBAEBCAAGBQJX/A12AAoJEPluif/UVmKKKJ0H/2qvuXm0RPZfIJbmeIPziQc+ d4Xm28ooesT2Bn23UbPn71ADGX2H1U3+AsEXcKM2U/osk0ViAksb9YaZLPGCDS+i xEbzwtCb6cCvPV5w2Uy/d+3BGgpZ+LcdAgy/VrFvQLJVAefI+GjRtQJTGbslohrB s0ca2Oc/kLRnUmykaAgqa6Ze1FVfrkZJDSMXyI+q4uzLJDjtwU+eIcomi7nGaC8z 0uic7iF0LniH9g8vd5N1UP/xewECOthUmEUuP0WNJTQOF3hfTTMn1NVwLDq4p8n2 1AIvSH0hYyIl2aa6SC/LK/kcssTvKp7htM6pOIsn3PDo/Gh/LVimBojkmhWcWAc= =F1Ak -----END PGP SIGNATURE-----
