| |||||||||||||
An odd vulnerability report for LibreOfficeAn odd vulnerability report for LibreOfficePosted Oct 6, 2011 9:06 UTC (Thu) by mjw (subscriber, #16740)In reply to: An odd vulnerability report for LibreOffice by jake Parent article: An odd vulnerability report for LibreOffice There is now also a new comment explaining why it was first thought to be a security issue and then not. Also included is a timeline that clearly mentions openoffice.org being notified weeks ago. Why the apache people weren't aware still is a bit of a mystery though (Assuming they are in control of openoffice.org now, maybe Oracle still haven't handed it all over? Or maybe the apache office project just don't have enough hackers to take care of security issues anymore?). It initially appeared that this flaw may be exploitable similar to CVE-2010-3452, where an OOB Read caused Arbitrary Code Execution. However in the case of this particular flaw, the junk data read is just parsed into an internal representation of properties and the maximum harm this should cause in application crash (Denial Of Service).
(Log in to post comments)
|
|||||||||||||