You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@openoffice.apache.org by bu...@apache.org on 2016/08/30 14:16:52 UTC
svn commit: r996269 - in /websites/staging/ooo-site/trunk: cgi-bin/ content/
content/security/cves/CVE-2016-1513.html
Author: buildbot
Date: Tue Aug 30 14:16:52 2016
New Revision: 996269
Log:
Staging update by buildbot for ooo-site
Modified:
websites/staging/ooo-site/trunk/cgi-bin/ (props changed)
websites/staging/ooo-site/trunk/content/ (props changed)
websites/staging/ooo-site/trunk/content/security/cves/CVE-2016-1513.html
Propchange: websites/staging/ooo-site/trunk/cgi-bin/
------------------------------------------------------------------------------
--- cms:source-revision (original)
+++ cms:source-revision Tue Aug 30 14:16:52 2016
@@ -1 +1 @@
-1758239
+1758393
Propchange: websites/staging/ooo-site/trunk/content/
------------------------------------------------------------------------------
--- cms:source-revision (original)
+++ cms:source-revision Tue Aug 30 14:16:52 2016
@@ -1 +1 @@
-1758239
+1758393
Modified: websites/staging/ooo-site/trunk/content/security/cves/CVE-2016-1513.html
==============================================================================
--- websites/staging/ooo-site/trunk/content/security/cves/CVE-2016-1513.html (original)
+++ websites/staging/ooo-site/trunk/content/security/cves/CVE-2016-1513.html Tue Aug 30 14:16:52 2016
@@ -43,10 +43,11 @@
</p>
<p>
- <strong>Version 1.0</strong>
+ <strong>Version 2.0</strong>
</p>
<p>
+ Updated August 30, 2016<br />
Announced July 21, 2016
</p>
@@ -57,6 +58,9 @@
<p>
An OpenDocument Presentation .ODP or Presentation Template .OTP file can contain invalid presentation elements that lead to memory corruption when the document is loaded in Apache OpenOffice Impress. The defect may cause the document to appear as corrupted and OpenOffice may crash in a recovery-stuck mode requiring manual intervention. A crafted exploitation of the defect can allow an attacker to cause denial of service (memory corruption and application crash) and possible execution of arbitrary code.
</p>
+ <p>Impress cannot be used to directly produce documents having the CVE-2016-1513-related defect. Impress-authored .ODF and .ODT
+ documents of an user's own that exhibit any of these characteristics are not the result of an exploit. They may be consequences
+ of a separate Impress defect that should be reported.
<p>
<strong>Severity: Medium</strong>
@@ -84,7 +88,8 @@
</p>
<p>
- There is no updated download currently available to mitigate this vulnerability. Until a hot fix or maintenance release is available, users should be vigilant and employ workarounds.
+ Install the 4.1.2-patch1 Hotfix available at
+ <a href="http://archive.apache.org/dist/openoffice/4.1.2-patch1/hotfix.html">http://archive.apache.org/dist/openoffice/4.1.2-patch1/hotfix.html</a>.
<br /><br />
A source-code patch that blocks the vulnerability has been developed and is available for developers at <a href="https://bz.apache.org/ooo/show_bug.cgi?id=127045">issue 127045</a>.
<br /><br />
@@ -96,17 +101,15 @@
</p>
<p>
- For defects such as those involved in CVE-2016-1513, documents can be crafted to cause memory corruption enough to crash Apache OpenOffice Impress. However, the conditions under which arbitrary code can be executed are complex and difficult to achieve in an undetected manner.
+ If you are unable to apply the Hotfix to Apache OpenOffice 4.1.2 (after updating to that version, if necessary), there are other
+ precautions that can be taken. These precautions are applicable in avoiding other possible exploits as well.
+ <br /><br />
+ For defects such as those involved in CVE-2016-1513, documents can be crafted to cause memory corruption enough to crash Apache OpenOffice.
+ Beyond that, however, the conditions under which arbitrary code can be executed are complex and difficult to achieve in an undetected manner.
<br /><br />
An important layer of defense for all such cases is to avoid operating Apache OpenOffice (and any other personal productivity programs) under a computer account that has administrative privileges of any kind. While installation of Apache OpenOffice requires elevated privileges and user permission on platforms such as Microsoft Windows, operation of the software does not.
<br /><br />
Keeping antivirus/antimalware software current is also important. This will serve to identify and distinguish suspicious documents that involve the exploit, avoiding confusion with documents that are damaged and/or fail for other reasons.
- <br /><br />
- Impress cannot be used to directly produce documents having the CVE-2016-1513-related defect. Impress-authored .ODP and .OTP documents of an user's own that exhibit any of these characteristics are not the result of an exploit. They may be consequences of a separate Impress defect that should be reported.
- <br /><br />
- For .ODP and .OTP files from unknown or suspicious sources, any automatic closing on opening or failing of OpenOffice Impress can be checked by opening the file in an OpenDocument Presentation application that is not vulnerable to the defective document formatting involved in CVE-2016-1513. Current releases of LibreOffice and Microsoft Office PowerPoint (for .ODP files), including PowerPoint Online, are known to avoid the defect. Other ODF-supporting software may be successful. The resulting presentation may appear corrupted or incomplete and need not reflect an actual exploit attempt. Saving the document as a new presentation file will be exploit-free either way.
- <br /><br />
- To report a suspicious document from an external source and for which OpenOffice Impress crashes, preserve the file exactly and report to <a href="mailto:security@openoffice.apache.org">security@openoffice.apache.org</a>. Await further instructions for submission of the file itself. Do not post files having suspected exploits to mailing lists, the issue-reporting system, or any other public location.
</p>
<p>