You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@openoffice.apache.org by or...@apache.org on 2015/10/28 05:12:35 UTC
svn commit: r1710937 -
/openoffice/ooo-site/trunk/content/security/cves/CVE-2015-1774.html
Author: orcmid
Date: Wed Oct 28 04:12:34 2015
New Revision: 1710937
URL: http://svn.apache.org/viewvc?rev=1710937&view=rev
Log:
Update CVE-2015-1774 to Version 2.0
Modified:
openoffice/ooo-site/trunk/content/security/cves/CVE-2015-1774.html
Modified: openoffice/ooo-site/trunk/content/security/cves/CVE-2015-1774.html
URL: http://svn.apache.org/viewvc/openoffice/ooo-site/trunk/content/security/cves/CVE-2015-1774.html?rev=1710937&r1=1710936&r2=1710937&view=diff
==============================================================================
--- openoffice/ooo-site/trunk/content/security/cves/CVE-2015-1774.html (original)
+++ openoffice/ooo-site/trunk/content/security/cves/CVE-2015-1774.html Wed Oct 28 04:12:34 2015
@@ -1,61 +1,77 @@
-<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html xmlns="http://www.w3.org/1999/xhtml">
-<head profile="http://www.w3.org/2005/10/profile">
- <title>CVE-2015-1774</title>
- <style type="text/css"></style>
-</head>
-
-<body>
- <h2><a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=2015-1774">CVE-2015-1774</a></h2>
-
- <h3>OpenOffice HWP Filter Remote Code Execution and Denial of Service Vulnerability</h3>
-
- <ul>
- <h4>Severity: Important</h4>
- <h4>Vendor: The Apache Software Foundation</h4>
- <h4>Versions Affected:</h4>
- <ul>
- <li>Apache OpenOffice 4.1.1 and older.</li>
- <li>OpenOffice.org versions are also affected.</li>
- </ul>
-
- <h4>Description</h4>
- <p>A vulnerability in OpenOffice's HWP filter allows attackers to cause a
-denial of service (memory corruption and application crash) or possibly
-execution of arbitrary code by preparing specially crafted documents in
-the HWP document format.</p>
-
- <h4>Mitigation</h4>
- <p>Apache OpenOffice users are advised to remove the problematic library in
-the "program" folder of their OpenOffice installation.
-On <strong>Windows</strong> it is named "hwp.dll"
-(step-by-step instructions: open the Apache OpenOffice program folder,
-usually "C:\Program Files (x86)\OpenOffice 4\program"; delete or rename
-any files whose name starts with "hwp"),
-on <strong>Mac OS X</strong> it is named "libhwp.dylib"
-(step-by-step instructions: go to the Applications folder in Finder;
-right click on OpenOffice.app; click on "Show Package Contents"; then
-search for the file "libhwp.dylib" with Finder's search function, or
-look for it in the folder "Contents/MacOS"; then delete the file)
-and on Linux it is named "libhwp.so".
-Alternatively the library can be renamed to anything
-else e.g. "hwp_renamed.dll".
-This mitigation will drop support for documents created in "Hangul
-Word Processor" versions from 1997 or older. Users of such documents are
-advised to convert their documents to other document formats such as
-OpenDocument before doing so.</p>
-
- <h4>Further information</h4>
- <p>Apache OpenOffice aims to fix the vulnerability in version 4.1.2.</p>
-
- <h4>Credits</h4>
- <p>Thanks to an anonymous contributor working with VeriSign iDefense Labs.</p>
-
- <hr />
-
- <p><a href="http://security.openoffice.org">Security Home</a>
- -> <a href="http://security.openoffice.org/bulletin.html">Bulletin</a>
- -> <a href="http://www.openoffice.org/security/cves/CVE-2015-1774.html">CVE-2015-1774</a></p>
-</body>
-</html>
-
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head profile="http://www.w3.org/2005/10/profile">
+ <title>CVE-2015-1774</title>
+ <style type="text/css"></style>
+</head>
+
+<body>
+ <h3><a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=2015-1774">CVE-2015-1774</a></h3>
+ <h3><a href="http://www.openoffice.org/security/cves/CVE-2015-1774.html">Apache OpenOffice Advisory</a></h3>
+
+ <h2>Out-of-Bounds Write in HWP File Filter</h2>
+
+ <dl>
+ <dt><strong>Version 2.0</strong></dt>
+ <dd>Announced April 27, 2015<br />
+ Updated October 28, 2015</dt>
+ </dl>
+
+ <p>
+ A vulnerability in OpenOffice's HWP filter allows attackers to cause a
+ denial of service (memory corruption and application crash) and possible
+ execution of arbitrary code.
+ </p>
+
+ <h4>Severity: Important</h4>
+ <h4>Vendor: The Apache Software Foundation</h4>
+ <dl>
+ <dt><strong>Versions Affected</strong></dt>
+ <dd>All Apache OpenOffice versions 4.1.1 and older are affected.<br />
+ OpenOffice.org versions are also affected.</dd>
+ </dl>
+
+
+ <h4>Mitigation</h4>
+ <p>Update to Apache OpenOffice 4.1.2 or a later version.</p>
+ <p>
+ This mitigation drops Apache OpenOffice support for documents
+ created in "Hangul Word Processor" format. The filter is not
+ installed; it will not be used if present.
+ </p>
+ <h4>Workarounds and Document Migration</h4>
+ <p>
+ Users of older HWP-format documents that are already trusted should
+ convert those documents to other formats before removing the filter
+ or upgrading to Apache OpenOffice version 4.1.2.
+ </p>
+ <p>
+ Apache OpenOffice users who do not upgrade can remove the
+ problematic filter themselves. The filter is in the "program"
+ folder of their OpenOffice installation. On <strong>Windows</strong>
+ the filter is named "hwp.dll", on <strong>Mac OS X</strong> it is named
+ "libhwp.dylib" and on <strong>Linux</strong> it is named "libhwp.so".
+ Alternatively the filter can be renamed to anything else (e.g.
+ "hwp_renamed.dll") to disable its use.
+ </p>
+
+
+
+ <h4>Further Information</h4>
+ <p>For additional information and assistance, consult the
+ <a href="https://forum.openoffice.org/">Apache OpenOffice Community Forums</a>
+ or make requests to the
+ <a href="mailto:users@openofffice.apache.org">users@openofffice.apache.org</a>
+ public mailing list.
+ </p>
+
+ <h4>Credits</h4>
+ <p>Thanks to an anonymous contributor working with VeriSign iDefense Labs.</p>
+
+ <hr />
+
+ <p><a href="http://security.openoffice.org">Security Home</a>
+ -> <a href="http://security.openoffice.org/bulletin.html">Bulletin</a>
+ -> <a href="http://www.openoffice.org/security/cves/CVE-2015-1774.html">CVE-2015-1774</a></p>
+</body>
+</html>