Vulnerabilities > CVE-2016-4324 - Improper Input Validation vulnerability in multiple products

CVSS 7.8 - HIGH

Attack vector

LOCAL

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

local

low complexity

nessus

NVD

Published: 2016-07-08

Updated: 2017-07-01

Summary

Use-after-free vulnerability in LibreOffice before 5.1.4 allows remote attackers to execute arbitrary code via a crafted RTF file, related to stylesheet and superscript tokens.

Vulnerable Configurations

Part	Description	Count
OS	Debian Debian Debian Linux 8.0	1
OS	Canonical Canonical Ubuntu Linux 12.04 Canonical Ubuntu Linux 16.04 Canonical Ubuntu Linux 15.10	3
Application	Libreoffice Libreoffice Libreoffice - Libreoffice Libreoffice 3.2.99.2 Libreoffice Libreoffice 3.2.99.3 Libreoffice Libreoffice 3.3.0.1 Libreoffice Libreoffice 3.3.0.2 Libreoffice Libreoffice 3.3.0.3 Libreoffice Libreoffice 3.3.0.4 Libreoffice Libreoffice 3.3.1.1 Libreoffice Libreoffice 3.3.2.1 Libreoffice Libreoffice 3.3.3.1 Libreoffice Libreoffice 3.3.4.1 Libreoffice Libreoffice 3.3.99.1 Libreoffice Libreoffice 3.3.99.2 Libreoffice Libreoffice 3.3.99.3 Libreoffice Libreoffice 3.3.99.4 Libreoffice Libreoffice 3.3.99.5 Libreoffice Libreoffice 3.3.202 Libreoffice Libreoffice 3.4.0.1 Libreoffice Libreoffice 3.4.0.2 Libreoffice Libreoffice 3.4.1.1 Libreoffice Libreoffice 3.4.2.1 Libreoffice Libreoffice 3.4.2.2 Libreoffice Libreoffice 3.4.2.3 Libreoffice Libreoffice 3.4.6 Libreoffice Libreoffice 3.4.99.0 Libreoffice Libreoffice 3.4.99.1 Libreoffice Libreoffice 3.4.99.2 Libreoffice Libreoffice 3.4.99.3 Libreoffice Libreoffice 3.5.0 Libreoffice Libreoffice 3.5.0.0 Libreoffice Libreoffice 3.5.0.1 Libreoffice Libreoffice 3.5.0.2 Libreoffice Libreoffice 3.5.0.3 Libreoffice Libreoffice 3.5.1.1 Libreoffice Libreoffice 3.5.1.2 Libreoffice Libreoffice 3.5.2 Libreoffice Libreoffice 3.5.2.1 Libreoffice Libreoffice 3.5.2.2 Libreoffice Libreoffice 3.5.3.1 Libreoffice Libreoffice 3.5.3.2 Libreoffice Libreoffice 3.5.4.1 Libreoffice Libreoffice 3.5.4.2 Libreoffice Libreoffice 3.5.5.1 Libreoffice Libreoffice 3.5.5.2 Libreoffice Libreoffice 3.5.5.3 Libreoffice Libreoffice 3.5.6.1 Libreoffice Libreoffice 3.5.7.1 Libreoffice Libreoffice 3.5.7.2 Libreoffice Libreoffice 3.5.98.1 Libreoffice Libreoffice 3.5.99.1 Libreoffice Libreoffice 3.6.0.0 Libreoffice Libreoffice 3.6.0.1 Libreoffice Libreoffice 3.6.0.2 Libreoffice Libreoffice 3.6.0.3 Libreoffice Libreoffice 3.6.0.4 Libreoffice Libreoffice 3.6.1.2 Libreoffice Libreoffice 3.6.2.1 Libreoffice Libreoffice 3.6.2.2 Libreoffice Libreoffice 3.6.3.1 Libreoffice Libreoffice 3.6.3.2 Libreoffice Libreoffice 3.6.4.1 Libreoffice Libreoffice 3.6.4.2 Libreoffice Libreoffice 3.6.4.3 Libreoffice Libreoffice 3.6.5.1 Libreoffice Libreoffice 3.6.5.2 Libreoffice Libreoffice 3.6.6.1 Libreoffice Libreoffice 3.6.6.2 Libreoffice Libreoffice 3.6.7.1 Libreoffice Libreoffice 3.6.7.2 Libreoffice Libreoffice 4.0.0 Libreoffice Libreoffice 4.0.0.0 Libreoffice Libreoffice 4.0.0.1 Libreoffice Libreoffice 4.0.0.2 Libreoffice Libreoffice 4.0.0.3 Libreoffice Libreoffice 4.0.1 Libreoffice Libreoffice 4.0.1.1 Libreoffice Libreoffice 4.0.1.2 Libreoffice Libreoffice 4.0.2 Libreoffice Libreoffice 4.0.2.1 Libreoffice Libreoffice 4.0.2.2 Libreoffice Libreoffice 4.0.3 Libreoffice Libreoffice 4.0.3.1 Libreoffice Libreoffice 4.0.3.2 Libreoffice Libreoffice 4.0.3.3 Libreoffice Libreoffice 4.0.4.1 Libreoffice Libreoffice 4.0.4.2 Libreoffice Libreoffice 4.0.5.1 Libreoffice Libreoffice 4.0.5.2 Libreoffice Libreoffice 4.0.6.1 Libreoffice Libreoffice 4.0.6.2 Libreoffice Libreoffice 4.1.0 Libreoffice Libreoffice 4.1.0.0 Libreoffice Libreoffice 4.1.0.1 Libreoffice Libreoffice 4.1.0.2 Libreoffice Libreoffice 4.1.0.3 Libreoffice Libreoffice 4.1.0.4 Libreoffice Libreoffice 4.1.1 Libreoffice Libreoffice 4.1.1.1 Libreoffice Libreoffice 4.1.1.2 Libreoffice Libreoffice 4.1.2 Libreoffice Libreoffice 4.1.2.1 Libreoffice Libreoffice 4.1.2.2 Libreoffice Libreoffice 4.1.2.3 Libreoffice Libreoffice 4.1.3 Libreoffice Libreoffice 4.1.3.1 Libreoffice Libreoffice 4.1.3.2 Libreoffice Libreoffice 4.1.4 Libreoffice Libreoffice 4.1.4.1 Libreoffice Libreoffice 4.1.4.2 Libreoffice Libreoffice 4.1.5.1 Libreoffice Libreoffice 4.1.5.2 Libreoffice Libreoffice 4.1.5.3 Libreoffice Libreoffice 4.1.6.1 Libreoffice Libreoffice 4.1.6.2 Libreoffice Libreoffice 4.2.0 Libreoffice Libreoffice 4.2.0.0 Libreoffice Libreoffice 4.2.0.1 Libreoffice Libreoffice 4.2.0.2 Libreoffice Libreoffice 4.2.0.3 Libreoffice Libreoffice 4.2.0.4 Libreoffice Libreoffice 4.2.1 Libreoffice Libreoffice 4.2.1.1 Libreoffice Libreoffice 4.2.2 Libreoffice Libreoffice 4.2.2.1 Libreoffice Libreoffice 4.2.3 Libreoffice Libreoffice 4.2.3.1 Libreoffice Libreoffice 4.2.3.2 Libreoffice Libreoffice 4.2.3.3 Libreoffice Libreoffice 4.2.4 Libreoffice Libreoffice 4.2.4.1 Libreoffice Libreoffice 4.2.4.2 Libreoffice Libreoffice 4.2.5 Libreoffice Libreoffice 4.2.5.1 Libreoffice Libreoffice 4.2.5.2 Libreoffice Libreoffice 4.2.6 Libreoffice Libreoffice 4.2.6.1 Libreoffice Libreoffice 4.2.6.2 Libreoffice Libreoffice 4.2.6.3 Libreoffice Libreoffice 4.2.7.1 Libreoffice Libreoffice 4.2.7.2 Libreoffice Libreoffice 4.2.8.1 Libreoffice Libreoffice 4.2.8.2 Libreoffice Libreoffice 4.3.0 Libreoffice Libreoffice 4.3.0.0 Libreoffice Libreoffice 4.3.0.1 Libreoffice Libreoffice 4.3.0.2 Libreoffice Libreoffice 4.3.0.3 Libreoffice Libreoffice 4.3.0.4 Libreoffice Libreoffice 4.3.1 Libreoffice Libreoffice 4.3.1.1 Libreoffice Libreoffice 4.3.1.2 Libreoffice Libreoffice 4.3.2 Libreoffice Libreoffice 4.3.2.1 Libreoffice Libreoffice 4.3.2.2 Libreoffice Libreoffice 4.3.3.1 Libreoffice Libreoffice 4.3.3.2 Libreoffice Libreoffice 4.3.4 Libreoffice Libreoffice 4.3.4.1 Libreoffice Libreoffice 4.3.5 Libreoffice Libreoffice 4.3.5.1 Libreoffice Libreoffice 4.3.5.2 Libreoffice Libreoffice 4.3.6 Libreoffice Libreoffice 4.3.6.1 Libreoffice Libreoffice 4.3.6.2 Libreoffice Libreoffice 4.3.7.1 Libreoffice Libreoffice 4.3.7.2 Libreoffice Libreoffice 4.4.0 Libreoffice Libreoffice 4.4.0.0 Libreoffice Libreoffice 4.4.0.1 Libreoffice Libreoffice 4.4.0.2 Libreoffice Libreoffice 4.4.0.3 Libreoffice Libreoffice 4.4.1 Libreoffice Libreoffice 4.4.1.1 Libreoffice Libreoffice 4.4.1.2 Libreoffice Libreoffice 4.4.2.1 Libreoffice Libreoffice 4.4.2.2 Libreoffice Libreoffice 4.4.3.1 Libreoffice Libreoffice 4.4.3.2 Libreoffice Libreoffice 4.4.4 Libreoffice Libreoffice 4.4.4.1 Libreoffice Libreoffice 4.4.4.2 Libreoffice Libreoffice 4.4.4.3 Libreoffice Libreoffice 4.4.5 Libreoffice Libreoffice 4.4.5.1 Libreoffice Libreoffice 4.4.5.2 Libreoffice Libreoffice 4.4.5.3 Libreoffice Libreoffice 4.4.6.1 Libreoffice Libreoffice 4.4.6.2 Libreoffice Libreoffice 4.4.6.3 Libreoffice Libreoffice 4.4.7.1 Libreoffice Libreoffice 4.4.7.2 Libreoffice Libreoffice 5.0.0.0 Libreoffice Libreoffice 5.0.0.1 Libreoffice Libreoffice 5.0.0.2 Libreoffice Libreoffice 5.0.0.3 Libreoffice Libreoffice 5.0.0.4 Libreoffice Libreoffice 5.0.0.5 Libreoffice Libreoffice 5.0.1.1 Libreoffice Libreoffice 5.0.1.2 Libreoffice Libreoffice 5.0.2.1 Libreoffice Libreoffice 5.0.2.2 Libreoffice Libreoffice 5.0.3 Libreoffice Libreoffice 5.0.3.1 Libreoffice Libreoffice 5.0.3.2 Libreoffice Libreoffice 5.0.4 Libreoffice Libreoffice 5.0.4.1 Libreoffice Libreoffice 5.0.4.2 Libreoffice Libreoffice 5.0.5 Libreoffice Libreoffice 5.0.5.1 Libreoffice Libreoffice 5.0.5.2 Libreoffice Libreoffice 5.0.6.1 Libreoffice Libreoffice 5.0.6.2 Libreoffice Libreoffice 5.0.6.3 Libreoffice Libreoffice 5.1.0.0 Libreoffice Libreoffice 5.1.0.1 Libreoffice Libreoffice 5.1.0.2 Libreoffice Libreoffice 5.1.0.3 Libreoffice Libreoffice 5.1.1.1 Libreoffice Libreoffice 5.1.1.2 Libreoffice Libreoffice 5.1.1.3 Libreoffice Libreoffice 5.1.2.1 Libreoffice Libreoffice 5.1.2.2	248

Common Weakness Enumeration (CWE)

CWE-20 - Improper Input Validation

Common Attack Pattern Enumeration and Classification (CAPEC)

Buffer Overflow via Environment Variables
This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
Server Side Include (SSI) Injection
An attacker can use Server Side Include (SSI) Injection to send code to a web application that then gets executed by the web server. Doing so enables the attacker to achieve similar results to Cross Site Scripting, viz., arbitrary code execution and information disclosure, albeit on a more limited scale, since the SSI directives are nowhere near as powerful as a full-fledged scripting language. Nonetheless, the attacker can conveniently gain access to sensitive files, such as password files, and execute shell commands.
Cross Zone Scripting
An attacker is able to cause a victim to load content into their web-browser that bypasses security zone controls and gain access to increased privileges to execute scripting code or other web objects such as unsigned ActiveX controls or applets. This is a privilege elevation attack targeted at zone-based web-browser security. In a zone-based model, pages belong to one of a set of zones corresponding to the level of privilege assigned to that page. Pages in an untrusted zone would have a lesser level of access to the system and/or be restricted in the types of executable content it was allowed to invoke. In a cross-zone scripting attack, a page that should be assigned to a less privileged zone is granted the privileges of a more trusted zone. This can be accomplished by exploiting bugs in the browser, exploiting incorrect configuration in the zone controls, through a cross-site scripting attack that causes the attackers' content to be treated as coming from a more trusted page, or by leveraging some piece of system functionality that is accessible from both the trusted and less trusted zone. This attack differs from "Restful Privilege Escalation" in that the latter correlates to the inadequate securing of RESTful access methods (such as HTTP DELETE) on the server, while cross-zone scripting attacks the concept of security zones as implemented by a browser.
Cross Site Scripting through Log Files
An attacker may leverage a system weakness where logs are susceptible to log injection to insert scripts into the system's logs. If these logs are later viewed by an administrator through a thin administrative interface and the log data is not properly HTML encoded before being written to the page, the attackers' scripts stored in the log will be executed in the administrative interface with potentially serious consequences. This attack pattern is really a combination of two other attack patterns: log injection and stored cross site scripting.
Command Line Execution through SQL Injection
An attacker uses standard SQL injection methods to inject data into the command line for execution. This could be done directly through misuse of directives such as MSSQL_xp_cmdshell or indirectly through injection of data into the database that would be interpreted as shell commands. Sometime later, an unscrupulous backend application (or could be part of the functionality of the same application) fetches the injected data stored in the database and uses this data as command line arguments without performing proper validation. The malicious data escapes that data plane by spawning new commands to be executed on the host.

Nessus

NASL family	Debian Local Security Checks
NASL id	DEBIAN_DLA-581.NASL
description	Aleksandar Nikolic discovered that missing input sanitising in the RTF parser in Libreoffice may result in the execution of arbitrary code if a malformed documented is opened. For Debian 7
last seen	2020-03-17
modified	2016-08-04
plugin id	92704
published	2016-08-04
reporter	This script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/92704
title	Debian DLA-581-1 : libreoffice security update
code	#%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Debian Security Advisory DLA-581-1. The text # itself is copyright (C) Software in the Public Interest, Inc. # include("compat.inc"); if (description) { script_id(92704); script_version("2.10"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/03/12"); script_cve_id("CVE-2016-4324"); script_name(english:"Debian DLA-581-1 : libreoffice security update"); script_summary(english:"Checks dpkg output for the updated packages."); script_set_attribute( attribute:"synopsis", value:"The remote Debian host is missing a security update." ); script_set_attribute( attribute:"description", value: "Aleksandar Nikolic discovered that missing input sanitising in the RTF parser in Libreoffice may result in the execution of arbitrary code if a malformed documented is opened. For Debian 7 'Wheezy', these problems have been fixed in version 1:3.5.4+dfsg2-0+deb7u7. We recommend that you upgrade your libreoffice packages. NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues." ); script_set_attribute( attribute:"see_also", value:"https://lists.debian.org/debian-lts-announce/2016/08/msg00003.html" ); script_set_attribute( attribute:"see_also", value:"https://packages.debian.org/source/wheezy/libreoffice" ); script_set_attribute(attribute:"solution", value:"Upgrade the affected packages."); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"exploit_available", value:"false"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:fonts-opensymbol"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-base"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-base-core"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-calc"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-common"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-core"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-dbg"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-dev"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-dev-doc"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-draw"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-emailmerge"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-evolution"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-filter-binfilter"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-filter-mobiledev"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-gcj"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-gnome"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-gtk"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-gtk3"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-help-ca"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-help-cs"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-help-da"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-help-de"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-help-dz"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-help-el"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-help-en-gb"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-help-en-us"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-help-es"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-help-et"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-help-eu"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-help-fi"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-help-fr"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-help-gl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-help-hi"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-help-hu"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-help-it"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-help-ja"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-help-km"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-help-ko"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-help-nl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-help-om"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-help-pl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-help-pt"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-help-pt-br"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-help-ru"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-help-sk"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-help-sl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-help-sv"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-help-zh-cn"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-help-zh-tw"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-impress"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-java-common"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-kde"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-af"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-ar"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-as"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-ast"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-be"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-bg"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-bn"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-br"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-bs"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-ca"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-cs"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-cy"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-da"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-de"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-dz"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-el"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-en-gb"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-en-za"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-eo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-es"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-et"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-eu"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-fa"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-fi"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-fr"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-ga"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-gl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-gu"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-he"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-hi"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-hr"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-hu"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-id"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-in"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-is"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-it"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-ja"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-ka"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-km"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-ko"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-ku"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-lt"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-lv"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-mk"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-ml"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-mn"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-mr"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-nb"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-ne"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-nl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-nn"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-nr"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-nso"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-oc"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-om"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-or"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-pa-in"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-pl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-pt"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-pt-br"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-ro"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-ru"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-rw"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-si"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-sk"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-sl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-sr"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-ss"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-st"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-sv"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-ta"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-te"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-tg"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-th"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-tn"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-tr"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-ts"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-ug"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-uk"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-uz"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-ve"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-vi"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-xh"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-za"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-zh-cn"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-zh-tw"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-l10n-zu"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-math"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-mysql-connector"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-officebean"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-ogltrans"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-pdfimport"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-presentation-minimizer"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-presenter-console"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-report-builder"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-report-builder-bin"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-script-provider-bsh"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-script-provider-js"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-script-provider-python"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-sdbc-postgresql"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-style-crystal"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-style-galaxy"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-style-hicontrast"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-style-oxygen"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-style-tango"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-wiki-publisher"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libreoffice-writer"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:openoffice.org-dtd-officedocument1.0"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:python-uno"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:python3-uno"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:ttf-opensymbol"); script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:7.0"); script_set_attribute(attribute:"patch_publication_date", value:"2016/08/03"); script_set_attribute(attribute:"plugin_publication_date", value:"2016/08/04"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Debian Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l"); exit(0); } include("audit.inc"); include("debian_package.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian"); if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING); flag = 0; if (deb_check(release:"7.0", prefix:"fonts-opensymbol", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-base", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-base-core", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-calc", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-common", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-core", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-dbg", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-dev", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-dev-doc", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-draw", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-emailmerge", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-evolution", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-filter-binfilter", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-filter-mobiledev", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-gcj", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-gnome", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-gtk", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-gtk3", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-help-ca", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-help-cs", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-help-da", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-help-de", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-help-dz", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-help-el", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-help-en-gb", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-help-en-us", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-help-es", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-help-et", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-help-eu", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-help-fi", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-help-fr", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-help-gl", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-help-hi", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-help-hu", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-help-it", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-help-ja", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-help-km", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-help-ko", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-help-nl", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-help-om", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-help-pl", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-help-pt", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-help-pt-br", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-help-ru", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-help-sk", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-help-sl", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-help-sv", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-help-zh-cn", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-help-zh-tw", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-impress", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-java-common", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-kde", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-af", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-ar", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-as", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-ast", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-be", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-bg", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-bn", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-br", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-bs", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-ca", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-cs", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-cy", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-da", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-de", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-dz", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-el", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-en-gb", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-en-za", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-eo", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-es", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-et", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-eu", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-fa", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-fi", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-fr", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-ga", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-gl", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-gu", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-he", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-hi", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-hr", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-hu", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-id", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-in", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-is", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-it", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-ja", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-ka", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-km", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-ko", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-ku", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-lt", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-lv", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-mk", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-ml", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-mn", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-mr", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-nb", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-ne", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-nl", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-nn", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-nr", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-nso", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-oc", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-om", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-or", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-pa-in", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-pl", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-pt", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-pt-br", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-ro", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-ru", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-rw", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-si", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-sk", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-sl", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-sr", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-ss", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-st", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-sv", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-ta", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-te", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-tg", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-th", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-tn", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-tr", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-ts", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-ug", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-uk", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-uz", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-ve", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-vi", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-xh", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-za", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-zh-cn", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-zh-tw", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-l10n-zu", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-math", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-mysql-connector", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-officebean", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-ogltrans", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-pdfimport", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-presentation-minimizer", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-presenter-console", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-report-builder", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-report-builder-bin", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-script-provider-bsh", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-script-provider-js", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-script-provider-python", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-sdbc-postgresql", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-style-crystal", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-style-galaxy", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-style-hicontrast", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-style-oxygen", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-style-tango", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-wiki-publisher", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"libreoffice-writer", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"openoffice.org-dtd-officedocument1.0", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"python-uno", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"python3-uno", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (deb_check(release:"7.0", prefix:"ttf-opensymbol", reference:"1:3.5.4+dfsg2-0+deb7u7")) flag++; if (flag) { if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get()); else security_warning(0); exit(0); } else audit(AUDIT_HOST_NOT, "affected");

NASL family	Windows
NASL id	LIBREOFFICE_514.NASL
description	The version of LibreOffice installed on the remote Windows host is prior to 5.1.4. It is, therefore, affected by a use-after-free error during Rich Text Format (RTF) file parsing due to improper validation of the RTF character style index. An unauthenticated, remote attacker can exploit this, by convincing a user to open a specially crafted RTF file, to execute arbitrary code. Note that Nessus has not tested for this issue but has instead relied only on the application
last seen	2020-06-01
modified	2020-06-02
plugin id	91974
published	2016-07-08
reporter	This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/91974
title	LibreOffice < 5.1.4 RTF Character Style Index RCE
code	# # (C) Tenable Network Security, Inc. # include("compat.inc"); if (description) { script_id(91974); script_version("1.8"); script_cvs_date("Date: 2019/11/19"); script_cve_id("CVE-2016-4324"); script_bugtraq_id(91499); script_name(english:"LibreOffice < 5.1.4 RTF Character Style Index RCE"); script_summary(english:"Checks the version of LibreOffice."); script_set_attribute(attribute:"synopsis", value: "An application installed on the remote host is affected by a remote code execution vulnerability."); script_set_attribute(attribute:"description", value: "The version of LibreOffice installed on the remote Windows host is prior to 5.1.4. It is, therefore, affected by a use-after-free error during Rich Text Format (RTF) file parsing due to improper validation of the RTF character style index. An unauthenticated, remote attacker can exploit this, by convincing a user to open a specially crafted RTF file, to execute arbitrary code. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number."); # https://www.libreoffice.org/about-us/security/advisories/cve-2016-4324/ script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?13884491"); # http://blog.talosintel.com/2016/06/vulnerability-spotlight-libreoffice-rtf.html script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?a9f01c39"); # http://www.talosintelligence.com/reports/TALOS-2016-0126/ script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?dc117572"); script_set_attribute(attribute:"solution", value: "Upgrade to LibreOffice version 5.1.4 or later."); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C"); script_set_attribute(attribute:"cvss_score_source", value:"CVE-2016-4324"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"exploit_available", value:"false"); script_set_attribute(attribute:"vuln_publication_date", value:"2016/06/27"); script_set_attribute(attribute:"patch_publication_date", value:"2016/06/28"); script_set_attribute(attribute:"plugin_publication_date", value:"2016/07/08"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"cpe:/a:libreoffice:libreoffice"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"Windows"); script_copyright(english:"This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_dependencies("libreoffice_installed.nasl"); script_require_keys("installed_sw/LibreOffice", "SMB/Registry/Enumerated"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("misc_func.inc"); include("install_func.inc"); app_name = "LibreOffice"; get_kb_item_or_exit("SMB/Registry/Enumerated"); install = get_single_install(app_name:app_name, exit_if_unknown_ver:TRUE); version = install['version']; version_ui = install['display_version']; path = install['path']; if ( # < 5.x version =~ "^[0-4]($\|[^0-9])" \|\| # 5.0 < 5.1 version =~ "^5\.0($\|[^0-9])" \|\| # 5.1 < 5.1.4 version =~ "^5\.1($\|\.[0-3])($\|[^0-9])" ) { port = get_kb_item("SMB/transport"); if (!port) port = 445; report = '\n Path : ' + path + '\n Installed version : ' + version_ui + '\n Fixed version : 5.1.4' + '\n'; security_report_v4(port:port, severity:SECURITY_WARNING, extra:report); exit(0); } else audit(AUDIT_INST_PATH_NOT_VULN, app_name, version_ui, path);

NASL family	Ubuntu Local Security Checks
NASL id	UBUNTU_USN-3022-1.NASL
description	It was discovered that LibreOffice incorrectly handled RTF document files. If a user were tricked into opening a specially crafted RTF document, a remote attacker could cause LibreOffice to crash, and possibly execute arbitrary code. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	91893
published	2016-06-30
reporter	Ubuntu Security Notice (C) 2016-2019 Canonical, Inc. / NASL script (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/91893
title	Ubuntu 12.04 LTS / 15.10 / 16.04 LTS : libreoffice vulnerability (USN-3022-1)
code	# # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Ubuntu Security Notice USN-3022-1. The text # itself is copyright (C) Canonical, Inc. See # <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered # trademark of Canonical, Inc. # include("compat.inc"); if (description) { script_id(91893); script_version("2.15"); script_cvs_date("Date: 2019/09/18 12:31:46"); script_cve_id("CVE-2016-4324"); script_xref(name:"USN", value:"3022-1"); script_name(english:"Ubuntu 12.04 LTS / 15.10 / 16.04 LTS : libreoffice vulnerability (USN-3022-1)"); script_summary(english:"Checks dpkg output for updated package."); script_set_attribute( attribute:"synopsis", value:"The remote Ubuntu host is missing a security-related patch." ); script_set_attribute( attribute:"description", value: "It was discovered that LibreOffice incorrectly handled RTF document files. If a user were tricked into opening a specially crafted RTF document, a remote attacker could cause LibreOffice to crash, and possibly execute arbitrary code. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues." ); script_set_attribute( attribute:"see_also", value:"https://usn.ubuntu.com/3022-1/" ); script_set_attribute( attribute:"solution", value:"Update the affected libreoffice-core package." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"exploit_available", value:"false"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libreoffice-core"); script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:12.04:-:lts"); script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:15.10"); script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:16.04"); script_set_attribute(attribute:"vuln_publication_date", value:"2016/07/08"); script_set_attribute(attribute:"patch_publication_date", value:"2016/06/29"); script_set_attribute(attribute:"plugin_publication_date", value:"2016/06/30"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"Ubuntu Security Notice (C) 2016-2019 Canonical, Inc. / NASL script (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Ubuntu Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/cpu", "Host/Ubuntu", "Host/Ubuntu/release", "Host/Debian/dpkg-l"); exit(0); } include("audit.inc"); include("ubuntu.inc"); include("misc_func.inc"); if ( ! get_kb_item("Host/local_checks_enabled") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/Ubuntu/release"); if ( isnull(release) ) audit(AUDIT_OS_NOT, "Ubuntu"); release = chomp(release); if (! preg(pattern:"^(12\.04\|15\.10\|16\.04)$", string:release)) audit(AUDIT_OS_NOT, "Ubuntu 12.04 / 15.10 / 16.04", "Ubuntu " + release); if ( ! get_kb_item("Host/Debian/dpkg-l") ) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Ubuntu", cpu); flag = 0; if (ubuntu_check(osver:"12.04", pkgname:"libreoffice-core", pkgver:"1:3.5.7-0ubuntu11")) flag++; if (ubuntu_check(osver:"15.10", pkgname:"libreoffice-core", pkgver:"1:5.0.6-0ubuntu1")) flag++; if (ubuntu_check(osver:"16.04", pkgname:"libreoffice-core", pkgver:"1:5.1.4-0ubuntu1")) flag++; if (flag) { security_report_v4( port : 0, severity : SECURITY_WARNING, extra : ubuntu_report_get() ); exit(0); } else { tested = ubuntu_pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libreoffice-core"); }

NASL family	SuSE Local Security Checks
NASL id	OPENSUSE-2016-1192.NASL
description	LibreOffice was updated to version 5.1.5.2, bringing enhancements and bug fixes. - CVE-2016-4324: Parsing the Rich Text Format character style index was insufficiently checked for validity. Documents could be constructed which dereference an iterator to the first entry of an empty STL container. (bsc#987553) - Don
last seen	2020-06-05
modified	2016-10-17
plugin id	94088
published	2016-10-17
reporter	This script is Copyright (C) 2016-2020 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/94088
title	openSUSE Security Update : libreoffice (openSUSE-2016-1192)
code	#%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from openSUSE Security Update openSUSE-2016-1192. # # The text description of this plugin is (C) SUSE LLC. # include("compat.inc"); if (description) { script_id(94088); script_version("2.4"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04"); script_cve_id("CVE-2016-4324"); script_name(english:"openSUSE Security Update : libreoffice (openSUSE-2016-1192)"); script_summary(english:"Check for the openSUSE-2016-1192 patch"); script_set_attribute( attribute:"synopsis", value:"The remote openSUSE host is missing a security update." ); script_set_attribute( attribute:"description", value: "LibreOffice was updated to version 5.1.5.2, bringing enhancements and bug fixes. - CVE-2016-4324: Parsing the Rich Text Format character style index was insufficiently checked for validity. Documents could be constructed which dereference an iterator to the first entry of an empty STL container. (bsc#987553) - Don't use 'nullable' for introspection, as it isn't available on SLE 12's version of gobject-introspection. This prevents a segmentation fault in gnome-documents. (bsc#1000102) This update was imported from the SUSE:SLE-12:Update update project." ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1000102" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.opensuse.org/show_bug.cgi?id=987553" ); script_set_attribute( attribute:"solution", value:"Update the affected libreoffice packages." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P"); script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-base"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-base-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-base-drivers-mysql"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-base-drivers-mysql-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-base-drivers-postgresql"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-base-drivers-postgresql-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-branding-upstream"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-calc"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-calc-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-calc-extensions"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-debugsource"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-draw"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-draw-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-filters-optional"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-gdb-pretty-printers"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-glade"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-gnome"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-gnome-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-gtk3"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-gtk3-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-icon-theme-breeze"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-icon-theme-galaxy"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-icon-theme-hicontrast"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-icon-theme-oxygen"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-icon-theme-sifr"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-icon-theme-tango"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-impress"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-impress-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-kde4"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-kde4-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-l10n-af"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-l10n-ar"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-l10n-as"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-l10n-bg"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-l10n-bn"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-l10n-br"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-l10n-ca"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-l10n-cs"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-l10n-cy"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-l10n-da"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-l10n-de"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-l10n-dz"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-l10n-el"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-l10n-en"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-l10n-es"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-l10n-et"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-l10n-eu"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-l10n-fa"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-l10n-fi"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-l10n-fr"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-l10n-ga"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-l10n-gl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-l10n-gu"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-l10n-he"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-l10n-hi"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-l10n-hr"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-l10n-hu"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-l10n-it"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-l10n-ja"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-l10n-kk"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-l10n-kn"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-l10n-ko"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-l10n-lt"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-l10n-lv"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-l10n-mai"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-l10n-ml"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-l10n-mr"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-l10n-nb"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-l10n-nl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-l10n-nn"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-l10n-nr"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-l10n-nso"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-l10n-or"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-l10n-pa"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-l10n-pl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-l10n-pt-BR"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-l10n-pt-PT"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-l10n-ro"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-l10n-ru"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-l10n-si"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-l10n-sk"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-l10n-sl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-l10n-sr"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-l10n-ss"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-l10n-st"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-l10n-sv"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-l10n-ta"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-l10n-te"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-l10n-th"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-l10n-tn"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-l10n-tr"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-l10n-ts"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-l10n-uk"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-l10n-ve"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-l10n-xh"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-l10n-zh-Hans"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-l10n-zh-Hant"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-l10n-zu"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-mailmerge"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-math"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-math-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-officebean"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-officebean-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-pyuno"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-pyuno-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-sdk"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-sdk-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-writer"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-writer-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreoffice-writer-extensions"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreofficekit"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libreofficekit-devel"); script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:42.1"); script_set_attribute(attribute:"patch_publication_date", value:"2016/10/14"); script_set_attribute(attribute:"plugin_publication_date", value:"2016/10/17"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2016-2020 Tenable Network Security, Inc."); script_family(english:"SuSE Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/SuSE/release"); if (isnull(release) \|\| release =~ "^(SLED\|SLES)") audit(AUDIT_OS_NOT, "openSUSE"); if (release !~ "^(SUSE42\.1)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "42.1", release); if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); ourarch = get_kb_item("Host/cpu"); if (!ourarch) audit(AUDIT_UNKNOWN_ARCH); if (ourarch !~ "^(x86_64)$") audit(AUDIT_ARCH_NOT, "x86_64", ourarch); flag = 0; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-base-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-base-debuginfo-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-base-drivers-mysql-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-base-drivers-mysql-debuginfo-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-base-drivers-postgresql-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-base-drivers-postgresql-debuginfo-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-branding-upstream-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-calc-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-calc-debuginfo-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-calc-extensions-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-debuginfo-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-debugsource-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-draw-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-draw-debuginfo-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-filters-optional-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-gdb-pretty-printers-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-glade-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-gnome-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-gnome-debuginfo-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-gtk3-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-gtk3-debuginfo-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-icon-theme-breeze-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-icon-theme-galaxy-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-icon-theme-hicontrast-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-icon-theme-oxygen-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-icon-theme-sifr-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-icon-theme-tango-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-impress-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-impress-debuginfo-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-kde4-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-kde4-debuginfo-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-l10n-af-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-l10n-ar-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-l10n-as-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-l10n-bg-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-l10n-bn-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-l10n-br-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-l10n-ca-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-l10n-cs-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-l10n-cy-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-l10n-da-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-l10n-de-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-l10n-dz-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-l10n-el-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-l10n-en-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-l10n-es-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-l10n-et-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-l10n-eu-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-l10n-fa-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-l10n-fi-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-l10n-fr-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-l10n-ga-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-l10n-gl-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-l10n-gu-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-l10n-he-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-l10n-hi-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-l10n-hr-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-l10n-hu-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-l10n-it-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-l10n-ja-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-l10n-kk-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-l10n-kn-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-l10n-ko-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-l10n-lt-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-l10n-lv-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-l10n-mai-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-l10n-ml-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-l10n-mr-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-l10n-nb-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-l10n-nl-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-l10n-nn-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-l10n-nr-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-l10n-nso-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-l10n-or-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-l10n-pa-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-l10n-pl-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-l10n-pt-BR-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-l10n-pt-PT-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-l10n-ro-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-l10n-ru-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-l10n-si-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-l10n-sk-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-l10n-sl-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-l10n-sr-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-l10n-ss-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-l10n-st-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-l10n-sv-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-l10n-ta-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-l10n-te-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-l10n-th-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-l10n-tn-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-l10n-tr-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-l10n-ts-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-l10n-uk-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-l10n-ve-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-l10n-xh-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-l10n-zh-Hans-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-l10n-zh-Hant-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-l10n-zu-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-mailmerge-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-math-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-math-debuginfo-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-officebean-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-officebean-debuginfo-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-pyuno-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-pyuno-debuginfo-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-sdk-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-sdk-debuginfo-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-writer-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-writer-debuginfo-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreoffice-writer-extensions-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreofficekit-5.1.5.2-11.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"libreofficekit-devel-5.1.5.2-11.1") ) flag++; if (flag) { if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get()); else security_warning(0); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libreoffice / libreoffice-base / libreoffice-base-debuginfo / etc"); }

NASL family	MacOS X Local Security Checks
NASL id	MACOSX_LIBREOFFICE_514.NASL
description	The version of LibreOffice installed on the remote macOS or Mac OS X host is prior to 5.1.4. It is, therefore, affected by a use-after-free error due to improper handling of the character style index when parsing RTF files. An unauthenticated, remote attacker can exploit this, by convincing a user to open a specially crafted RTF file, to execute arbitrary code. Note that Nessus has not tested for this issue but has instead relied only on the application
last seen	2020-06-01
modified	2020-06-02
plugin id	91975
published	2016-07-08
reporter	This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/91975
title	LibreOffice < 5.1.4 RTF Character Style Index RCE (macOS)
code	# # (C) Tenable Network Security, Inc. # include("compat.inc"); if (description) { script_id(91975); script_version("1.9"); script_cvs_date("Date: 2019/11/14"); script_cve_id("CVE-2016-4324"); script_bugtraq_id(91499); script_name(english:"LibreOffice < 5.1.4 RTF Character Style Index RCE (macOS)"); script_summary(english:"Checks the version of LibreOffice."); script_set_attribute(attribute:"synopsis", value: "An application installed on the remote host is affected by a remote code execution vulnerability."); script_set_attribute(attribute:"description", value: "The version of LibreOffice installed on the remote macOS or Mac OS X host is prior to 5.1.4. It is, therefore, affected by a use-after-free error due to improper handling of the character style index when parsing RTF files. An unauthenticated, remote attacker can exploit this, by convincing a user to open a specially crafted RTF file, to execute arbitrary code. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number."); # https://www.libreoffice.org/about-us/security/advisories/cve-2016-4324/ script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?13884491"); # http://blog.talosintel.com/2016/06/vulnerability-spotlight-libreoffice-rtf.html script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?a9f01c39"); # http://www.talosintelligence.com/reports/TALOS-2016-0126/ script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?dc117572"); script_set_attribute(attribute:"solution", value: "Upgrade to LibreOffice version 5.1.4 or later."); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C"); script_set_attribute(attribute:"cvss_score_source", value:"CVE-2016-4324"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"exploit_available", value:"false"); script_set_attribute(attribute:"vuln_publication_date", value:"2016/06/27"); script_set_attribute(attribute:"patch_publication_date", value:"2016/06/28"); script_set_attribute(attribute:"plugin_publication_date", value:"2016/07/08"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"cpe:/a:libreoffice:libreoffice"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"MacOS X Local Security Checks"); script_copyright(english:"This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_dependencies("macosx_libreoffice_installed.nasl"); script_require_keys("installed_sw/LibreOffice", "Host/MacOSX/Version"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("misc_func.inc"); include("install_func.inc"); app_name = "LibreOffice"; get_kb_item_or_exit("Host/MacOSX/Version"); install = get_single_install(app_name:app_name, exit_if_unknown_ver:TRUE); version = install['version']; path = install['path']; if ( # < 5.x version =~ "^[0-4]($\|[^0-9])" \|\| # 5.0 < 5.1 version =~ "^5\.0($\|[^0-9])" \|\| # 5.1 < 5.1.4 version =~ "^5\.1($\|\.[0-3])($\|[^0-9])" ) { report = '\n Path : ' + path + '\n Installed version : ' + version + '\n Fixed version : 5.1.4' + '\n'; security_report_v4(port:0, severity:SECURITY_WARNING, extra:report); exit(0); } else audit(AUDIT_INST_PATH_NOT_VULN, app_name, version, path);

NASL family	Fedora Local Security Checks
NASL id	FEDORA_2016-F0552E1341.NASL
description	Security fix for CVE-2016-4324 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-05
modified	2016-07-15
plugin id	92302
published	2016-07-15
reporter	This script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/92302
title	Fedora 23 : 1:libreoffice (2016-f0552e1341)
code	#%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Fedora Security Advisory FEDORA-2016-f0552e1341. # include("compat.inc"); if (description) { script_id(92302); script_version("2.7"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04"); script_cve_id("CVE-2016-4324"); script_xref(name:"FEDORA", value:"2016-f0552e1341"); script_name(english:"Fedora 23 : 1:libreoffice (2016-f0552e1341)"); script_summary(english:"Checks rpm output for the updated package."); script_set_attribute( attribute:"synopsis", value:"The remote Fedora host is missing a security update." ); script_set_attribute( attribute:"description", value: "Security fix for CVE-2016-4324 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues." ); script_set_attribute( attribute:"see_also", value:"https://bodhi.fedoraproject.org/updates/FEDORA-2016-f0552e1341" ); script_set_attribute( attribute:"solution", value:"Update the affected 1:libreoffice package." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P"); script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:1:libreoffice"); script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:23"); script_set_attribute(attribute:"vuln_publication_date", value:"2016/07/08"); script_set_attribute(attribute:"patch_publication_date", value:"2016/07/05"); script_set_attribute(attribute:"plugin_publication_date", value:"2016/07/15"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Fedora Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/RedHat/release"); if (isnull(release) \|\| "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora"); os_ver = pregmatch(pattern: "Fedora.*release ([0-9]+)", string:release); if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora"); os_ver = os_ver[1]; if (! preg(pattern:"^23([^0-9]\|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 23", "Fedora " + os_ver); if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu); flag = 0; if (rpm_check(release:"FC23", reference:"libreoffice-5.0.6.2-9.fc23", epoch:"1")) flag++; if (flag) { security_report_v4( port : 0, severity : SECURITY_WARNING, extra : rpm_report_get() ); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "1:libreoffice"); }

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2016-2472-1.NASL
description	LibreOffice was updated to version 5.1.5.2, bringing enhancements and bug fixes. - CVE-2016-4324: Parsing the Rich Text Format character style index was insufficiently checked for validity. Documents could be constructed which dereference an iterator to the first entry of an empty STL container. (bsc#987553) - Don
last seen	2020-06-01
modified	2020-06-02
plugin id	93910
published	2016-10-07
reporter	This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/93910
title	SUSE SLED12 Security Update : libreoffice (SUSE-SU-2016:2472-1)

NASL family	Debian Local Security Checks
NASL id	DEBIAN_DSA-3608.NASL
description	Aleksandar Nikolic discovered that missing input sanitising in the RTF parser in Libreoffice may result in the execution of arbitrary code if a malformed documented is opened.
last seen	2020-06-01
modified	2020-06-02
plugin id	91891
published	2016-06-30
reporter	This script is Copyright (C) 2016-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/91891
title	Debian DSA-3608-1 : libreoffice - security update

NASL family	Gentoo Local Security Checks
NASL id	GENTOO_GLSA-201611-03.NASL
description	The remote host is affected by the vulnerability described in GLSA-201611-03 (LibreOffice, OpenOffice: Multiple vulnerabilities) Multiple vulnerabilities have been found in both LibreOffice and OpenOffice. Please review the referenced CVE’s for specific information regarding each. Impact : Remote attackers could obtain sensitive information, cause a Denial of Service condition, or execute arbitrary code. Workaround : There is no known work around at this time.
last seen	2020-06-01
modified	2020-06-02
plugin id	94594
published	2016-11-07
reporter	This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/94594
title	GLSA-201611-03 : LibreOffice, OpenOffice: Multiple vulnerabilities

NASL family	FreeBSD Local Security Checks
NASL id	FREEBSD_PKG_3159CD704AAA11E6A7BD14DAE9D210B8.NASL
description	Talos reports : An exploitable Use After Free vulnerability exists in the RTF parser LibreOffice. A specially crafted file can cause a use after free resulting in a possible arbitrary code execution. To exploit the vulnerability a malicious file needs to be opened by the user via vulnerable application.
last seen	2020-06-01
modified	2020-06-02
plugin id	92340
published	2016-07-18
reporter	This script is Copyright (C) 2016-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/92340
title	FreeBSD : libreoffice -- use-after-free vulnerability (3159cd70-4aaa-11e6-a7bd-14dae9d210b8)

Seebug

bulletinFamily	exploit
description	### SUMMARY An exploitable Use After Free vulnerability exists in the RTF parser LibreOffice. A specially crafted file can cause a use after free resulting in a possible arbitrary code execution. To exploit the vulnerability a malicious file needs to be opened by the user via vulnerable application. ### TESTED VERSIONS The Document Foundation LibreOffice 5.0.4 ### PRODUCT URLs https://www.libreoffice.org/download/libreoffice-fresh/ ### CVSSv3 SCORE [6.3] - [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L] ### DETAILS LibreOffice is a popular open source office suite. An use after free vulnerability is present in the RTF parser of the lates release. The core of the vulnerability lies in the way documents containing both stylesheet and superscript tokens are parsed. A malformed document with `\super` token in top group causes the invalid parser operation. A minimal example testcase triggering the vulnerability is: ``` {\rtf1 {\stylesheet {;}} Hello world \super hello } ``` It can be observed that the token `super` (a keyword for supperscript text) is in outermost group while the stylesheet is in its own inner group. In an usual RTF document, superscript would be in an inner group too. Looking at the code, for each new token a new parser state is pushed to the state stack: ``` RTFError RTFDocumentImpl::pushState() { //SAL_INFO("writerfilter", OSL_THIS_FUNC << " before push: " << m_pTokenizer->getGroup()); checkUnicode(/bUnicode =/ true, /bHex =/ true); m_nGroupStartPos = Strm().Tell(); if (m_aStates.empty()) m_aStates.push(m_aDefaultState); else { // fdo#85812 group resets run type of _current_ and new state (but not RTL) m_aStates.top().eRunType = RTFParserState::LOCH; if (m_aStates.top().eDestination == Destination::MR) lcl_DestinationToMath(m_aStates.top().pDestinationText, m_aMathBuffer, m_bMathNor); m_aStates.push(m_aStates.top()); } m_aStates.top().aDestinationText.setLength(0); // was copied: always reset! ``` It should be noted that variable `m_aStates` above is of type `RTFStack` which is a warper for STL deque container. In this specific case, the states are popped and subsequently freed in the `popState` method, specifically at line 5844: ``` m_aStates.pop(); m_pTokenizer->popGroup(); ``` By observing the process under debugger, it can be observed that `popState` is called one time too many, leading to an access to an invalid pointer which eventually crashes the process at: ``` writerfilter::Reference<Properties>::Pointer_t RTFDocumentImpl::getProperties(RTFSprms& rAttributes, RTFSprms& rSprms) { int nStyle = 0; if (!m_aStates.empty()) nStyle = m_aStates.top().nCurrentStyleIndex; RTFReferenceTable::Entries_t::iterator it = m_aStyleTableEntries.find(nStyle); if (it != m_aStyleTableEntries.end()) { RTFReferenceProperties& rProps = static_cast<RTFReferenceProperties>(it->second.get()); // cloneAndDeduplicate() wants to know about only a single "style", so // let's merge paragraph and character style properties here. int nCharStyle = m_aStates.top().nCurrentCharacterStyleIndex; // crashes here ``` The invalid memory being dereferenced ultimately comes from a previously used chunk on the heap of size 0x50 which is allocated during one of the `pushState` calls: ``` gdb$ bt #0 0xffffffff in void std::deque<writerfilter::rtftok::RTFParserState, std::allocator<writerfilter::rtftok::RTFParserState> >::_M_push_back_aux<writerfilter::rtftok::RTFParserState const&>(writerfilter::rtftok::RTFParserState const&) () at /opt/libreoffice5.0/program/../program/libwriterfilterlo.so #1 0xffffffff in writerfilter::rtftok::RTFDocumentImpl::pushState() () at /opt/libreoffice5.0/program/../program/libwriterfilterlo.so #2 0xffffffff in writerfilter::rtftok::RTFTokenizer::resolveParse() () at /opt/libreoffice5.0/program/../program/libwriterfilterlo.so #3 0xffffffff in writerfilter::rtftok::RTFDocumentImpl::resolve(writerfilter::Stream&) () at /opt/libreoffice5.0/program/../program/libwriterfilterlo.so #4 0xffffffff in RtfFilter::filter(com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) () at /opt/libreoffice5.0/program/../program/libwriterfilterlo.so #5 0xffffffff in SfxObjectShell::ImportFrom(SfxMedium&, com::sun::star::uno::Reference<com::sun::star::text::XTextRange> const&) () at /opt/libreoffice5.0/program/libmergedlo.so #6 0xffffffff in SfxObjectShell::DoLoad(SfxMedium) () at /opt/libreoffice5.0/program/libmergedlo.so #7 0xffffffff in SfxBaseModel::load(com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) () at /opt/libreoffice5.0/program/libmergedlo.so ``` A truncated callstack shows that the debugger is stopped inside a `push_back` method of the RTFStack deque. ``` gdb$ x/10i $pc-5 0xabc26224 <+192>: call 0xabbff5a0 <operator new(unsigned int)@plt> => 0xabc26229 <+197>: mov edx,DWORD PTR [ebp-0x1c] 0xabc2622c <+200>: add esp,0xc 0xabc2622f <+203>: mov DWORD PTR [ebp-0x24],edx 0xabc26232 <+206>: mov ecx,eax 0xabc26234 <+208>: mov eax,edx 0xabc26236 <+210>: sub eax,edi 0xabc26238 <+212>: shr eax,1 0xabc2623a <+214>: lea edi,[ecx+eax4] 0xabc2623d <+217>: push edi ``` Disassembly of at the breakpoint shows a call to a new operator which allocates an array of 18 unsigned ints. The heap chunk returned is in eax and can be observed to be in use: ``` gdb$ x/x $eax 0x873c200: 0xb5131968 gdb$ x/x $eax-4 0x873c1fc: 0x00000051 ``` The chunk is located at 0x873c200 and is 80 bytes in size. This chunk is later freed in a `popState` call but it's content is ultimately accessed again just before the crash. The program crashes inside `writerfilter::Reference<Properties>::Pointer_t RTFDocumentImpl::getProperties`: ``` Program received signal SIGSEGV, Segmentation fault. gdb$ x/3i $pc-8 0xabc03898 <+156>: call 0xabc1e6de <std::deque<writerfilter::rtftok::RTFParserState, std::allocator<writerfilter::rtftok::RTFParserState> >::back()> 0xabc0389d <+161>: add esp,0xc => 0xabc038a0 <+164>: mov eax,DWORD PTR [eax+0x1c4] gdb$ i r eax eax 0x19 0x19 gdb$ ``` In the above debugger output, the process crashes due to a read access violation. Contents of register `eax` above come from the previous call to `back`: ``` gdb$ disassemble 0xabc1e6de Dump of assembler code for function _ZNSt5dequeIN12writerfilter6rtftok14RTFParserStateESaIS2_EE4backEv: 0xabc1e6de <+0>: push ebp 0xabc1e6df <+1>: mov ebp,esp 0xabc1e6e1 <+3>: mov edx,DWORD PTR [ebp+0x8] 0xabc1e6e4 <+6>: mov eax,DWORD PTR [edx+0x18] 0xabc1e6e7 <+9>: cmp eax,DWORD PTR [edx+0x1c] 0xabc1e6ea <+12>: mov ecx,DWORD PTR [edx+0x24] 0xabc1e6ed <+15>: jne 0xabc1e6f7 <std::deque<writerfilter::rtftok::RTFParserState, std::allocator<writerfilter::rtftok::RTFParserState> >::back()+25> 0xabc1e6ef <+17>: mov eax,DWORD PTR [ecx-0x4] [1] 0xabc1e6f2 <+20>: add eax,0x1d4 0xabc1e6f7 <+25>: sub eax,0x1d4 0xabc1e6fc <+30>: pop ebp 0xabc1e6fd <+31>: ret End of assembler dump. gdb$ x/x $ecx-4 0x873c214: 0x00000019 ``` In the above disassembly, the final value of eax ultimately comes from an address pointed at by `ecx-4` [1] which actually points inside the previously freed chunk. Observe that the buffer is inside the chunk (chunk was at 0x873c200 and was 80 bytes) which has been allocated by another part of the code in the mean time. Further memory layout control could potentially allow for more abuse and ultimately for code execution. By careful heap manipulation, a dereferenced pointer can be put under control which can be demonstrated by the following (shortened) testcase: ``` {\rtf{\upr{\ud{\fonttbl{}}}} {\stylesheet { Normal;} } \super a}AAAAAAA..... ``` Opening the above testcase in LibreOffice results in the same crash but with obvious control over the pointer: ``` Program received signal SIGSEGV, Segmentation fault. [----------------------------------registers-----------------------------------] EAX: 0x41414141 ('AAAA') EBX: 0xabd6e460 --> 0x187244 ECX: 0x88595c8 --> 0x8810440 --> 0x880ff08 --> 0xabd69840 (:rtftok::RTFDocumentImpl+8>: 0xabc01cf6) EDX: 0x880ff48 --> 0x88595b0 --> 0xb5131870 --> 0x885bbc0 --> 0x0 ESI: 0xbfffd7d4 --> 0xabc1e74c (<std::__shared_count<(__gnu_cxx::_Lock_policy)2>::__shared_count(std::__shared_count<(__gnu_cxx::_Lock_policy)2> const&)+14>: add ecx,0x14fd14) EDI: 0x88103e4 --> 0x0 EBP: 0xbfffd808 --> 0xbfffd898 --> ESP: 0xbfffd79c --> 0xbfffd7bc --> 0x882d7b8 --> 0x1 EIP: 0xabc038a0 (<writerfilter::rtftok::RTFDocumentImpl::getProperties(writerfilter::rtftok::RTFSprms&, writerfilter::rtftok::RTFSprms&)+164>: mov eax,DWORD PTR [eax+0x1c4]) EFLAGS: 0x210286 (carry PARITY adjust zero SIGN trap INTERRUPT direction overflow) [-------------------------------------code-------------------------------------] 0xabc03895 <writerfilter::rtftok::RTFDocumentImpl::getProperties()+153>: mov DWORD PTR [ebp-0x64],eax 0xabc03898 <writerfilter::rtftok::RTFDocumentImpl::getProperties()+156>: call 0xabc1e6de <std::deque::back()> 0xabc0389d <writerfilter::rtftok::RTFDocumentImpl::getProperties()+161>: add esp,0xc => 0xabc038a0 <writerfilter::rtftok::RTFDocumentImpl::getProperties()+164>: mov eax,DWORD PTR [eax+0x1c4] 0xabc038a6 <writerfilter::rtftok::RTFDocumentImpl::getProperties()+170>: mov DWORD PTR [ebp-0x3c],eax 0xabc038a9 <writerfilter::rtftok::RTFDocumentImpl::getProperties()+173>: lea eax,[ebp-0x3c] 0xabc038ac <writerfilter::rtftok::RTFDocumentImpl::getProperties()+176>: push eax 0xabc038ad <writerfilter::rtftok::RTFDocumentImpl::getProperties()+177>: push edi 0xabc038a0 in writerfilter::rtftok::RTFDocumentImpl::getProperties() () from /opt/libreoffice5.0/program/../program/libwriterfilterlo.so gdb$ ``` Further process and memory state manipulation is needed to possibly turn this arbitrary read into code execution. ### CRASH INFORMATION ``` Program received signal SIGSEGV, Segmentation fault. 0xabc038a0 in writerfilter::rtftok::RTFDocumentImpl::getProperties(writerfilter::rtftok::RTFSprms&, writerfilter::rtftok::RTFSprms&) () from /opt/libreoffice5.0/program/../program/libwriterfilterlo.so Missing separate debuginfos, use: debuginfo-install libreoffice5.0-5.0.4.2-2.i586 (gdb) exploitable Description: Access violation on source operand Short description: SourceAv (19/22) Hash: af3c01fefebc302b00a13ca8b7b6f323.5bf63181b180fb2d4e93814d425f662e Exploitability Classification: UNKNOWN Explanation: The target crashed on an access violation at an address matching the source operand of the current instruction. This likely indicates a read access violation. Other tags: AccessViolation (21/22) (gdb) ``` ### TIMELINE 2016-04-13 - Initial Vendor Contact * 2016-06-27 - Public Release
id	SSV:96735
last seen	2017-11-19
modified	2017-10-19
published	2017-10-19
reporter	Root
title	The Document Foundation LibreOffice RTF Stylesheet Code Execution Vulnerability(CVE-2016-4324)

Talos

id	TALOS-2016-0126
last seen	2019-05-29
published	2016-06-27
reporter	Talos Intelligence
source	http://www.talosintelligence.com/vulnerability_reports/TALOS-2016-0126
title	The Document Foundation LibreOffice RTF Stylesheet Code Execution Vulnerability

Vulnerabilities > CVE-2016-4324 - Improper Input Validation vulnerability in multiple products

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

Nessus

Seebug

Talos

Related news

References