CVE-2012-4233

NameCVE-2012-4233
DescriptionLibreOffice 3.5.x before 3.5.7.2 and 3.6.x before 3.6.1, and OpenOffice.org (OOo), allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted (1) odt file to vcllo.dll, (2) ODG (Drawing document) file to svxcorelo.dll, (3) PolyPolygon record in a .wmf (Window Meta File) file embedded in a ppt (PowerPoint) file to tllo.dll, or (4) xls (Excel) file to scfiltlo.dll.
SourceCVE (at NVD; oss-sec, fulldisc, OSVDB, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, more)
ReferencesDSA-2570-1
NVD severitymedium (attack range: remote, user-initiated)
Debian/oldoldstablenot vulnerable.
Debian/oldstablenot vulnerable.
Debian/stablenot vulnerable.
Debian/testingnot vulnerable.
Debian/unstablenot vulnerable.

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
libreoffice (PTS)wheezy1:3.5.4+dfsg2-0+deb7u2fixed
wheezy (security)1:3.5.4+dfsg2-0+deb7u4fixed
jessie1:4.3.3-2fixed
jessie (security)1:4.3.3-2+deb8u1fixed
stretch, sid1:4.4.3-1fixed
openoffice.org (PTS)squeeze, squeeze (security)1:3.2.1-11+squeeze8fixed
wheezy1:3.4.0~ooo340m1-7fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
libreofficesource(unstable)1:3.5.4+dfsg-3low
openoffice.orgsource(unstable)1:3.3.0-1low
openoffice.orgsourcesqueeze1:3.2.1-11+squeeze8mediumDSA-2570-1

Notes

Since 3.3.0 openoffice.org is a transitional source package
https://www.htbridge.com/advisory/HTB23106

Search for package or bug name: Reporting problems