CVE-2012-0037

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2012-0037
Redland Raptor (aka libraptor) before 2.0.7, as used by OpenOffice 3.3 and 3.4 Beta, LibreOffice before 3.4.6 and 3.5.x before 3.5.1, and other products, allows user-assisted remote attackers to read arbitrary files via a crafted XML external entity (XXE) declaration and reference in an RDF document.

6.5 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.3 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References
Link Resource
http://www.debian.org/security/2012/dsa-2438 Third Party Advisory
http://www.libreoffice.org/advisories/CVE-2012-0037/ Vendor Advisory
http://secunia.com/advisories/48493 Broken Link Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2012-0411.html Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2012-0410.html Third Party Advisory
http://www.osvdb.org/80307 Broken Link
http://secunia.com/advisories/48529 Broken Link Vendor Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2012:063 Broken Link
http://www.openwall.com/lists/oss-security/2012/03/27/4 Exploit Mailing List
http://www.mandriva.com/security/advisories?name=MDVSA-2012:062 Broken Link
http://secunia.com/advisories/48526 Broken Link Vendor Advisory
http://librdf.org/raptor/RELEASE.html#rel2_0_7 Release Notes
http://secunia.com/advisories/48479 Broken Link Vendor Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2012:061 Broken Link
http://secunia.com/advisories/48542 Broken Link Vendor Advisory
http://vsecurity.com/resources/advisory/20120324-1/ Broken Link
http://www.securityfocus.com/bid/52681 Broken Link Third Party Advisory VDB Entry
http://blog.documentfoundation.org/2012/03/22/tdf-announces-libreoffice-3-4-6/ Release Notes
http://secunia.com/advisories/48494 Broken Link
http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078242.html Mailing List
http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077708.html Mailing List
http://secunia.com/advisories/48649 Broken Link
http://www.securitytracker.com/id?1026837 Broken Link Third Party Advisory VDB Entry
http://security.gentoo.org/glsa/glsa-201209-05.xml Third Party Advisory
http://secunia.com/advisories/50692 Broken Link
https://github.com/dajobe/raptor/commit/a676f235309a59d4aa78eeffd2574ae5d341fcb0 Patch
http://secunia.com/advisories/60799 Broken Link
http://www.gentoo.org/security/en/glsa/glsa-201408-19.xml Third Party Advisory
http://www.openoffice.org/security/cves/CVE-2012-0037.html Mitigation Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/74235 Third Party Advisory VDB Entry
https://lists.apache.org/thread.html/re0504f08000df786e51795940501e81a5d0ae981ecca68141e87ece0%40%3Ccommits.openoffice.apache.org%3E Mailing List Patch
Configurations

Configuration 1 (hide)

cpe:2.3:a:librdf:raptor:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:libreoffice:libreoffice:3.5.0:*:*:*:*:*:*:*
cpe:2.3:a:libreoffice:libreoffice:*:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:a:apache:openoffice:3.3.0:*:*:*:*:*:*:*
cpe:2.3:a:apache:openoffice:3.4.0:beta:*:*:*:*:*:*

Configuration 4 (hide)

OR cpe:2.3:o:fedoraproject:fedora:17:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:16:*:*:*:*:*:*:*

Configuration 5 (hide)

OR cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:6.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:storage:2.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:storage_for_public_cloud:2.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:6.2:*:*:*:*:*:*:*
cpe:2.3:a:redhat:gluster_storage_server_for_on-premise:2.0:*:*:*:*:*:*:*

Configuration 6 (hide)

cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*
History

15 Feb 2024, 03:22

Type Values Removed Values Added
CPE cpe:2.3:a:libreoffice:libreoffice:3.3.2:*:*:*:*:*:*:*
cpe:2.3:a:apache:openoffice.org:3.4:beta:*:*:*:*:*:*
cpe:2.3:a:libreoffice:libreoffice:3.3.0:*:*:*:*:*:*:*
cpe:2.3:a:libreoffice:libreoffice:3.3.4:*:*:*:*:*:*:*
cpe:2.3:a:libreoffice:libreoffice:3.3.1:*:*:*:*:*:*:*
cpe:2.3:a:apache:openoffice.org:3.3:*:*:*:*:*:*:*
cpe:2.3:a:libreoffice:libreoffice:3.5:*:*:*:*:*:*:*
cpe:2.3:a:redland:libraptor:*:*:*:*:*:*:*:*
cpe:2.3:a:libreoffice:libreoffice:3.4.0:*:*:*:*:*:*:*
cpe:2.3:a:libreoffice:libreoffice:3.3.3:*:*:*:*:*:*:*
cpe:2.3:a:libreoffice:libreoffice:3.4.1:*:*:*:*:*:*:*
cpe:2.3:a:libreoffice:libreoffice:3.4.2:*:*:*:*:*:*:*
cpe:2.3:a:libreoffice:libreoffice:3.4.5:*:*:*:*:*:*:*		 cpe:2.3:a:apache:openoffice:3.3.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:6.2:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:17:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:16:*:*:*:*:*:*:*
cpe:2.3:a:libreoffice:libreoffice:3.5.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:gluster_storage_server_for_on-premise:2.0:*:*:*:*:*:*:*
cpe:2.3:a:libreoffice:libreoffice:*:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:storage_for_public_cloud:2.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*
cpe:2.3:a:librdf:raptor:*:*:*:*:*:*:*:*
cpe:2.3:a:apache:openoffice:3.4.0:beta:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:storage:2.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:6.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*
References (MISC) http://vsecurity.com/resources/advisory/20120324-1/ - (MISC) http://vsecurity.com/resources/advisory/20120324-1/ - Broken Link
References (SECUNIA) http://secunia.com/advisories/48649 - (SECUNIA) http://secunia.com/advisories/48649 - Broken Link
References (CONFIRM) http://librdf.org/raptor/RELEASE.html#rel2_0_7 - (CONFIRM) http://librdf.org/raptor/RELEASE.html#rel2_0_7 - Release Notes
References (SECUNIA) http://secunia.com/advisories/48493 - Vendor Advisory (SECUNIA) http://secunia.com/advisories/48493 - Broken Link, Vendor Advisory
References (SECTRACK) http://www.securitytracker.com/id?1026837 - (SECTRACK) http://www.securitytracker.com/id?1026837 - Broken Link, Third Party Advisory, VDB Entry
References (GENTOO) http://security.gentoo.org/glsa/glsa-201209-05.xml - (GENTOO) http://security.gentoo.org/glsa/glsa-201209-05.xml - Third Party Advisory
References (FEDORA) http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077708.html - (FEDORA) http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077708.html - Mailing List
References (BID) http://www.securityfocus.com/bid/52681 - (BID) http://www.securityfocus.com/bid/52681 - Broken Link, Third Party Advisory, VDB Entry
References (SECUNIA) http://secunia.com/advisories/48479 - Vendor Advisory (SECUNIA) http://secunia.com/advisories/48479 - Broken Link, Vendor Advisory
References (SECUNIA) http://secunia.com/advisories/48494 - (SECUNIA) http://secunia.com/advisories/48494 - Broken Link
References (CONFIRM) http://blog.documentfoundation.org/2012/03/22/tdf-announces-libreoffice-3-4-6/ - (CONFIRM) http://blog.documentfoundation.org/2012/03/22/tdf-announces-libreoffice-3-4-6/ - Release Notes
References (SECUNIA) http://secunia.com/advisories/50692 - (SECUNIA) http://secunia.com/advisories/50692 - Broken Link
References (SECUNIA) http://secunia.com/advisories/60799 - (SECUNIA) http://secunia.com/advisories/60799 - Broken Link
References (XF) https://exchange.xforce.ibmcloud.com/vulnerabilities/74235 - (XF) https://exchange.xforce.ibmcloud.com/vulnerabilities/74235 - Third Party Advisory, VDB Entry
References (SECUNIA) http://secunia.com/advisories/48542 - Vendor Advisory (SECUNIA) http://secunia.com/advisories/48542 - Broken Link, Vendor Advisory
References (GENTOO) http://www.gentoo.org/security/en/glsa/glsa-201408-19.xml - (GENTOO) http://www.gentoo.org/security/en/glsa/glsa-201408-19.xml - Third Party Advisory
References (REDHAT) http://rhn.redhat.com/errata/RHSA-2012-0411.html - (REDHAT) http://rhn.redhat.com/errata/RHSA-2012-0411.html - Third Party Advisory
References (FEDORA) http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078242.html - (FEDORA) http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078242.html - Mailing List
References (CONFIRM) http://www.openoffice.org/security/cves/CVE-2012-0037.html - (CONFIRM) http://www.openoffice.org/security/cves/CVE-2012-0037.html - Mitigation, Patch
References (MLIST) http://www.openwall.com/lists/oss-security/2012/03/27/4 - (MLIST) http://www.openwall.com/lists/oss-security/2012/03/27/4 - Exploit, Mailing List
References (REDHAT) http://rhn.redhat.com/errata/RHSA-2012-0410.html - (REDHAT) http://rhn.redhat.com/errata/RHSA-2012-0410.html - Third Party Advisory
References (DEBIAN) http://www.debian.org/security/2012/dsa-2438 - (DEBIAN) http://www.debian.org/security/2012/dsa-2438 - Third Party Advisory
References (SECUNIA) http://secunia.com/advisories/48529 - Vendor Advisory (SECUNIA) http://secunia.com/advisories/48529 - Broken Link, Vendor Advisory
References (MANDRIVA) http://www.mandriva.com/security/advisories?name=MDVSA-2012:063 - (MANDRIVA) http://www.mandriva.com/security/advisories?name=MDVSA-2012:063 - Broken Link
References (MISC) https://lists.apache.org/thread.html/re0504f08000df786e51795940501e81a5d0ae981ecca68141e87ece0%40%3Ccommits.openoffice.apache.org%3E - (MISC) https://lists.apache.org/thread.html/re0504f08000df786e51795940501e81a5d0ae981ecca68141e87ece0%40%3Ccommits.openoffice.apache.org%3E - Mailing List, Patch
References (MANDRIVA) http://www.mandriva.com/security/advisories?name=MDVSA-2012:062 - (MANDRIVA) http://www.mandriva.com/security/advisories?name=MDVSA-2012:062 - Broken Link
References (OSVDB) http://www.osvdb.org/80307 - (OSVDB) http://www.osvdb.org/80307 - Broken Link
References (CONFIRM) https://github.com/dajobe/raptor/commit/a676f235309a59d4aa78eeffd2574ae5d341fcb0 - (CONFIRM) https://github.com/dajobe/raptor/commit/a676f235309a59d4aa78eeffd2574ae5d341fcb0 - Patch
References (MANDRIVA) http://www.mandriva.com/security/advisories?name=MDVSA-2012:061 - (MANDRIVA) http://www.mandriva.com/security/advisories?name=MDVSA-2012:061 - Broken Link
References (SECUNIA) http://secunia.com/advisories/48526 - Vendor Advisory (SECUNIA) http://secunia.com/advisories/48526 - Broken Link, Vendor Advisory
CVSS v2 : 4.3
v3 : unknown 		v2 : 4.3
v3 : 6.5
First Time Librdf
Redhat enterprise Linux Desktop
Apache openoffice
Fedoraproject
Debian
Redhat storage For Public Cloud
Redhat enterprise Linux Server Aus
Fedoraproject fedora
Redhat enterprise Linux Workstation
Redhat storage
Debian debian Linux
Redhat enterprise Linux Eus
Redhat gluster Storage Server For On-premise
Librdf raptor
Redhat enterprise Linux Server
Redhat
CWE CWE-200 CWE-611
Information

Published : 2012-06-17 03:41

Updated : 2024-02-15 03:22

NVD link : CVE-2012-0037

Mitre link : CVE-2012-0037

JSON object : View

Products Affected

debian

  • debian_linux

librdf

  • raptor

apache

  • openoffice

libreoffice

  • libreoffice

fedoraproject

  • fedora

redhat

  • storage
  • enterprise_linux_desktop
  • gluster_storage_server_for_on-premise
  • enterprise_linux_eus
  • enterprise_linux_server
  • enterprise_linux_server_aus
  • enterprise_linux_workstation
  • storage_for_public_cloud
CWE
CWE-611

Improper Restriction of XML External Entity Reference