[tdf-discuss] security related information, CVE-2016-10327, CVE-2017-7856, CVE-2017-7870, CVE-2017-7882

tl;dr: All users are recommended to upgrade to LibreOffice >= 5.2.5 or
> = 5.3.0.

Recently 4 CVEs were filed for LibreOffice, namely...

CVE-2016-10327 Heap-buffer-overflow in EMF filter
CVE-2017-7856  Heap-buffer-overflow in WMF filter
CVE-2017-7882  Heap-buffer-overflow in HWP filter
CVE-2017-7870  Heap-buffer-overflow in WMF filter polygon processing

They are all related to the google oss-fuzz program (https://testing.go
ogleblog.com/2016/12/announcing-oss-fuzz-continuous-fuzzing.html) of
which we are part

These two:

CVE-2017-7856  Heap-buffer-overflow in WMF filter
CVE-2017-7882  Heap-buffer-overflow in HWP filter

refer to temporary defects which were introduced during the development
cycle and then fixed again before any release was made, so there is no
release affected by these specific issues.


These two however *are* in released products:

https://www.libreoffice.org/about-us/security/advisories/CVE-2016-10327
CVE-2016-10327 Heap-buffer-overflow in EMF filter

Enhanced Metafiles (EMF) can contain bitmap data preceded by a header
and a field with in that header which states the offset from the start
of the header to the bitmap data. An emf can be crafted to provide an
illegal offset which if not tested for validity can trigger a heap
buffer overflow.

https://www.libreoffice.org/about-us/security/advisories/CVE-2017-7870
CVE-2017-7870  Heap-buffer-overflow in WMF filter polygon processing

Windows Metafiles (WMF) can contain polygons which under certain
circumstances when processed (split) can result in output polygons
which have too many points to be represented by LibreOffice's internal
polygon class. resulting in a heap buffer overflow could occur as the
attempt to split the polygon was assumed to succeed.

Everything is fixed in 5.2.5 and 5.3.0

-- 
To unsubscribe e-mail to: discuss+unsubscribe@documentfoundation.org
Problems? http://www.libreoffice.org/get-help/mailing-lists/how-to-unsubscribe/
Posting guidelines + more: http://wiki.documentfoundation.org/Netiquette
List archive: http://listarchives.documentfoundation.org/www/discuss/
All messages sent to this list will be publicly archived and cannot be deleted