PublicDateAtUSN: 2012-03-22
Candidate: CVE-2012-0037
PublicDate: 2012-06-17 03:41:00 UTC
CRD: 2012-03-22
References: 
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0037
 http://blog.documentfoundation.org/2012/03/22/tdf-announces-libreoffice-3-4-6/
 http://www.openoffice.org/security/cves/CVE-2012-0037.html
 http://www.openoffice.org/security/cves/CVE-2012-0037-src.txt
 https://www.libreoffice.org/advisories/CVE-2012-0037/
 https://ubuntu.com/security/notices/USN-1480-1
 https://ubuntu.com/security/notices/USN-1901-1
Description:
 Redland Raptor (aka libraptor) before 2.0.7, as used by OpenOffice 3.3 and
 3.4 Beta, LibreOffice before 3.4.6 and 3.5.x before 3.5.1, and other
 products, allows user-assisted remote attackers to read arbitrary files via
 a crafted XML external entity (XXE) declaration and reference in an RDF
 document.
Ubuntu-Description:
Notes:
 jdstrand> Per Sweetchark, only a LibreOffice issue if using internal raptor
 jdstrand> Debian's patch for 1.4.21 from David Beckett based on patch sent to
  linux-distros@
 jdstrand> per RedHat, arbitrary code execution is possible as well
 jdstrand> 1.4.21-7 is claimed to be fixed in Debian. While a patch was added,
  the quilt series file was not updated so the patch was not applied.
Bugs:
 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-0037
 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=677427
Priority: medium
Discovered-by: Timothy D. Morgan
Assigned-to: mdeslaur
CVSS: 

Patches_openoffice.org:
 other: http://mail-archives.apache.org/mod_mbox/incubator-ooo-commits/201201.mbox/%3C20120112081652.0B5CD2388860@eris.apache.org%3E
upstream_openoffice.org: needs-triage
hardy_openoffice.org: ignored (reached end-of-life)
lucid_openoffice.org: not-affected (uses system raptor)
maverick_openoffice.org: ignored (reached end-of-life)
natty_openoffice.org: not-affected (transitional packages)
oneiric_openoffice.org: not-affected (transitional packages)
precise_openoffice.org: not-affected (transitional packages)
quantal_openoffice.org: DNE
raring_openoffice.org: DNE
devel_openoffice.org: DNE

Patches_libreoffice:
upstream_libreoffice: released (3.4.6, 3.5.1)
hardy_libreoffice: DNE
lucid_libreoffice: DNE
maverick_libreoffice: DNE
natty_libreoffice: not-affected (uses system raptor)
oneiric_libreoffice: not-affected (uses system raptor)
precise_libreoffice: not-affected (1:3.5.3-0ubuntu1)
quantal_libreoffice: not-affected
raring_libreoffice: not-affected
devel_libreoffice: not-affected

Patches_raptor:
 vendor: http://www.debian.org/security/2012/dsa-2438
 upstream: https://github.com/dajobe/raptor/commit/a676f235309a59d4aa78eeffd2574ae5d341fcb0.patch
upstream_raptor: released (1.4.21-7.1)
hardy_raptor: ignored (reached end-of-life)
lucid_raptor: released (1.4.21-1ubuntu1.1)
maverick_raptor: ignored (reached end-of-life)
natty_raptor: released (1.4.21-2ubuntu0.1)
oneiric_raptor: released (1.4.21-5ubuntu0.1)
precise_raptor: released (1.4.21-7ubuntu0.1)
quantal_raptor: released (1.4.21-7ubuntu1)
raring_raptor: not-affected
devel_raptor: not-affected

Patches_raptor2:
 upstream: https://github.com/dajobe/raptor/commit/a9ddbb9d804264ed6b9cf9f6d46eed77b515b5d1.patch (backport)
 upstream: https://github.com/dajobe/raptor/commit/359a56a5774dbde8d7a773c4c60aaed53abecc8c.patch (backport)
 upstream: https://github.com/dajobe/raptor/commit/a676f235309a59d4aa78eeffd2574ae5d341fcb0.patch
upstream_raptor2: released (2.0.7)
lucid_raptor2: DNE
precise_raptor2: released (2.0.6-1ubuntu0.1)
quantal_raptor2: not-affected (2.0.8-1)
raring_raptor2: not-affected (2.0.8-2)
devel_raptor2: not-affected (2.0.9-1)