Author: robweir
Date: Wed May 16 13:40:06 2012
New Revision: 1339161
URL: http://svn.apache.org/viewvc?rev=1339161&view=rev
Log:
new bulletins
Added:
incubator/ooo/ooo-site/trunk/content/security/cves/CVE-2012-1149.html
incubator/ooo/ooo-site/trunk/content/security/cves/CVE-2012-2149.html
incubator/ooo/ooo-site/trunk/content/security/cves/CVE-2012-2334.html
Added: incubator/ooo/ooo-site/trunk/content/security/cves/CVE-2012-1149.html
URL:
http://svn.apache.org/viewvc/incubator/ooo/ooo-site/trunk/content/security/cves/CVE-2012-1149.html?rev=1339161&view=auto
==============================================================================
--- incubator/ooo/ooo-site/trunk/content/security/cves/CVE-2012-1149.html
(added)
+++ incubator/ooo/ooo-site/trunk/content/security/cves/CVE-2012-1149.html Wed
May 16 13:40:06 2012
@@ -0,0 +1,52 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd";>
+
+<html xmlns="http://www.w3.org/1999/xhtml";>
+<head profile="http://www.w3.org/2005/10/profile";>
+ <title>CVE-2012-1149</title>
+ <style type="text/css"></style>
+</head>
+
+<body>
+ <h2><a
+
href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=2012-1149";>CVE-2012-1149</a></h2>
+
+ <h3>
+ OpenOffice.org integer overflow error in vclmi.dll module when allocating
+ memory for an embedded image object
+ </h3>
+
+ <ul>
+
+ <h4>Severity: Important</h4>
+
+ <h4>Vendor: The Apache Software Foundation</h4>
+
+ <h4>Versions Affected:</h4>
+ <ul>
+ <li>OpenOffice.org 3.3 and 3.4 Beta, on
all platforms.</li>
+ <li>Earlier versions may be also
affected.</li>
+ </ul>
+
+
+<h4>Description:</h4>
+<p> The vulnerability is caused due to an integer overflow error in the
+vclmi.dll module when allocating memory for an embedded image object. This can
+be exploited to cause a heap-based buffer overflow via, for example using a
+specially crafted JPEG object within a DOC file.</p>
+
+ <h4>Mitigation</h4>
+ <p>OpenOffice.org 3.3.0 and 3.4 beta users are advised to <a
+href="http://download.openoffice.org";>upgrade to Apache OpenOffice 3.4<a/>.
Users who are unable to upgrade immediately
+should be cautious when opening untrusted documents.</p>
+
+<h4>Credits</h4>
+
+<p>The Apache OpenOffice Security Team credits Tielei Wang via Secunia SVCRP
as
+ the discoverer of this flaw.</p>
+
+ <hr />
+
+ <p><a href="http://security.openoffice.org";>Security Home</a> -> <a
href="../bulletin.html">Bulletin</a> ->
+ <a href="CVE-2012-1149.html">CVE-2012-1149</a></p>
+</body>
+</html>
Added: incubator/ooo/ooo-site/trunk/content/security/cves/CVE-2012-2149.html
URL:
http://svn.apache.org/viewvc/incubator/ooo/ooo-site/trunk/content/security/cves/CVE-2012-2149.html?rev=1339161&view=auto
==============================================================================
--- incubator/ooo/ooo-site/trunk/content/security/cves/CVE-2012-2149.html
(added)
+++ incubator/ooo/ooo-site/trunk/content/security/cves/CVE-2012-2149.html Wed
May 16 13:40:06 2012
@@ -0,0 +1,49 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd";>
+
+<html xmlns="http://www.w3.org/1999/xhtml";>
+<head profile="http://www.w3.org/2005/10/profile";>
+ <title>CVE-2012-2149</title>
+ <style type="text/css"></style>
+</head>
+
+<body>
+ <h2><a
href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=2012-2149";>CVE-2012-2149</a></h2>
+
+ <h3>
+ OpenOffice.org memory overwrite vulnerability
+ </h3>
+
+ <ul>
+
+ <h4>Severity: Important</h4>
+
+ <h4>Vendor: The Apache Software Foundation</h4>
+
+ <h4>Versions Affected:</h4>
+ <ul>
+ <li>OpenOffice.org 3.3 and 3.4 Beta, on
all platforms.</li>
+ <li>Earlier versions may be also
affected.</li>
+ </ul>
+
+
+<h4>Description:</h4>
+<p>
+Description: Effected versions of OpenOffice.org use a customized libwpd that
has an memory overwrite vulnerability that could be exploited by
+a specially crafted Wordperfect WPD-format document, potentially leading to
arbitrary-code execution at application user privilege level.</p>
+
+ <h4>Mitigation</h4>
+ <p>OpenOffice.org 3.3.0 and 3.4 beta users are advised to <a
+href="http://download.openoffice.org";>upgrade to Apache OpenOffice 3.4</a>,
where
+WPD files are ignored. Users who are unable to upgrade immediately should be
+cautious when oppening untrusted WPD documents.</p>
+
+<h4>Credits</h4>
+
+<p>The Apache OpenOffice Security Team acknowledges Kestutis Gudinavicius of
SEC Consult Unternehmensberatung GmbH as the discoverer of this flaw.</p>
+
+ <hr />
+
+ <p><a href="http://security.openoffice.org";>Security Home</a> -> <a
href="../bulletin.html">Bulletin</a> ->
+ <a href="CVE-2012-2149.html">CVE-2012-2149</a></p>
+</body>
+</html>
Added: incubator/ooo/ooo-site/trunk/content/security/cves/CVE-2012-2334.html
URL:
http://svn.apache.org/viewvc/incubator/ooo/ooo-site/trunk/content/security/cves/CVE-2012-2334.html?rev=1339161&view=auto
==============================================================================
--- incubator/ooo/ooo-site/trunk/content/security/cves/CVE-2012-2334.html
(added)
+++ incubator/ooo/ooo-site/trunk/content/security/cves/CVE-2012-2334.html Wed
May 16 13:40:06 2012
@@ -0,0 +1,44 @@
+<!doctype html public "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd";>
+<html xmlns="http://www.w3.org/1999/xhtml";>
+<head profile="http://www.w3.org/2005/10/profile";>
+ <title>CVE-2012-2334</title>
+ <style type="text/css">
+ </style>
+</head>
+<body>
+<h2><a
+href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=2012-2334";>CVE-2012-2334</a></h2>
<h3>Vulnerabilities related to
+malformed Powerpoint files in OpenOffice.org 3.3.0</h3>
+<ul>
+ <h4>Severity: Important</h4> <h4>Vendor: The Apache Software
Foundation</h4> <h4>Versions Affected:</h4>
+ <ul>
+ <li>
+ OpenOffice.org 3.3 and 3.4 Beta, on all platforms.
+ </li>
+ <li>
+ Earlier versions may be also affected.
+ </li>
+ </ul>
+ <h4>Description:</h4>
+ <p>
+ A review of the code in filter/source/msfilter msdffimp.cxx revealed some
unchecked memory allocations, which could be
+ exploited via malformed Powerpoint graphics records ("escher") to cause
bad_alloc exceptions. From this vulnerability a
+ denial of service attack is possible.
+ </p>
+ <h4>Mitigation</h4>
+ <p>
+ OpenOffice.org 3.3.0 and 3.4 beta users are advised to <a
+ href="http://download.openoffice.org";>upgrade to Apache OpenOffice
3.4<a/>. Users who are unable to upgrade immediately
+ should be cautious when opening untrusted documents.
+ </p>
+ <h4>Credits</h4>
+ <p>
+ The Apache OpenOffice Security Team credits Sven Jacobias as the
discoverer
+ of this flaw.
+ </p>
+ <hr />
+ <p>
+ <a href="http://security.openoffice.org";>Security Home</a> -> <a
href="../bulletin.html">Bulletin</a> -> <a
href="CVE-2012-2334.html">CVE-2012-2334</a>
+ </p>
+</body>
+</html>
