CVE-2012-0037

Quick assessment

Copy summary Copy citation

Affected

n/a n/a

Exploitation

High exploitation probability; assess promptly

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

OpenOffice.org（OOo）是美国阿帕奇（Apache）软件基金会的一款开源的办公软件套件。该套件包含文本文档、电子表格、演示文稿、绘图、数据库等。 OpenOffice.org中存在敏感信息泄露漏洞，此漏洞源于ODF文档内的某些XML组件在处理XML外部实体时的一个错误。攻击者可利用该漏洞通过特制XML实体，揭露ODF文档内的任意文件的内容。运行在Windows和Mac OS X上的OpenOffice.org 3.3版本中存在该漏洞，其他版本也可能受到影响。

CVE-2012-0037 affects n/a n/a. High exploitation probability; assess promptly. OpenOffice.org（OOo）是美国阿帕奇（Apache）软件基金会的一款开源的办公软件套件。该套件包含文本文档、电子表格、演示文稿、绘图、数据库等。 OpenOffice.org中存在敏感信息泄露漏洞，此漏洞源于ODF文档内的某些XML组件在处理XML外部实体时的一个错误。攻击者可利用该漏洞通过特制XML实体，揭露ODF文档内的任意文件的内容。运行 CVE-2012-0037 vulnerability details, Shenlong CVE Platform, https://cve.imfht.com/detail/CVE-2012-0037

I. Basic Information for CVE-2012-0037

Affected Products

II. Public POCs for CVE-2012-0037

III. Intelligence Information for CVE-2012-0037

Patches & Fixes for CVE-2012-0037 (1)

• https://github.com/dajobe/raptor/commit/a676f235309a59d4aa78eeffd2574ae5d341fcb0 x_refsource_CONFIRM

Vendor Advisories for CVE-2012-0037 (20)

• http://secunia.com/advisories/48494 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/48479 third-party-advisory x_refsource_SECUNIA
• http://www.osvdb.org/80307 vdb-entry x_refsource_OSVDB
• http://secunia.com/advisories/48649 third-party-advisory x_refsource_SECUNIA
• http://www.securityfocus.com/bid/52681 vdb-entry x_refsource_BID
• http://secunia.com/advisories/48493 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/48529 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/48526 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/50692 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/48542 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/60799 third-party-advisory x_refsource_SECUNIA
• http://www.securitytracker.com/id?1026837 vdb-entry x_refsource_SECTRACK
• http://www.debian.org/security/2012/dsa-2438 vendor-advisory x_refsource_DEBIAN
• http://security.gentoo.org/glsa/glsa-201209-05.xml vendor-advisory x_refsource_GENTOO
• http://rhn.redhat.com/errata/RHSA-2012-0410.html vendor-advisory x_refsource_REDHAT
• http://www.mandriva.com/security/advisories?name=MDVSA-2012:063 vendor-advisory x_refsource_MANDRIVA
• http://www.mandriva.com/security/advisories?name=MDVSA-2012:062 vendor-advisory x_refsource_MANDRIVA
• http://www.mandriva.com/security/advisories?name=MDVSA-2012:061 vendor-advisory x_refsource_MANDRIVA
• http://rhn.redhat.com/errata/RHSA-2012-0411.html vendor-advisory x_refsource_REDHAT
• https://exchange.xforce.ibmcloud.com/vulnerabilities/74235 vdb-entry x_refsource_XF

Mailing List Discussions for CVE-2012-0037 (4)

• http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077708.html vendor-advisory x_refsource_FEDORA
• http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078242.html vendor-advisory x_refsource_FEDORA
• http://www.openwall.com/lists/oss-security/2012/03/27/4 mailing-list x_refsource_MLIST
• https://lists.apache.org/thread.html/re0504f08000df786e51795940501e81a5d0ae981ecca68141e87ece0%40%3Ccommits.openoffice.apache.org%3E mailing-list x_refsource_MLIST

Security Blog Posts for CVE-2012-0037 (1)

• http://blog.documentfoundation.org/2012/03/22/tdf-announces-libreoffice-3-4-6/ x_refsource_CONFIRM

Other References for CVE-2012-0037 (5)

• http://www.libreoffice.org/advisories/CVE-2012-0037/ x_refsource_CONFIRM
• http://www.openoffice.org/security/cves/CVE-2012-0037.html x_refsource_CONFIRM
• http://librdf.org/raptor/RELEASE.html#rel2_0_7 x_refsource_CONFIRM
• http://vsecurity.com/resources/advisory/20120324-1/ x_refsource_MISC
• http://www.gentoo.org/security/en/glsa/glsa-201408-19.xml vendor-advisory x_refsource_GENTOO

• https://www.cve.org/CVERecord?id=CVE-2012-0037

Same Patch Batch · n/a · 2012-06-17 · 13 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2012-0037