Caolán Mcnamara

يحدث تجاوز في ذاكرة التخزين المؤقت للكومة (heap buffer overflow) عندما يقرأ برنامج تشغيل قاعدة بيانات dBASE ملفات الفهرس (.ndx) المستخدمة كمصدر للبيانات. تنشأ المشكلة لأن عدد الإدخالات المسجلة في الصفحة لا يتم التحقق منه مقابل السعة القصوى المحددة في رأس الفهرس. بالإضافة إلى ذلك، يمكن لفهرس مصمم خصيصاً أن يجعل الصفحة تشير إلى نفسها، مما يؤدي إلى تكرار لا نهائي أثناء عملية القراءة.

LibreOffice Calc allows linking a cell range to an external data source, with the link being saved within the document. This mechanism can be abused to open an embedded Firebird database that enables writing a file to any location accessible to the user.

LibreOffice Calc allows linking a cell range to an external csv data source, with the link being saved within the document. Because these links are fetched during the document loading process, opening a malicious document can lead to Local File Inclusion (LFI), where a local file is read into the sheet, or Server-Side Request Forgery (SSRF), where a request is made to a host selected by the document creator. This occurs via `calcext:data-mappings` and the csv provider.

LibreOffice Calc allows linking a cell range to an external data source, with the link stored within the document. A link using the sql type can designate a folder containing local text files as a database. This allows an attacker to read local text files into a sheet when a document is opened. This is a Local File Inclusion (LFI) issue, where an application is tricked into exposing or executing files on the local system.

On Linux, the software uses GStreamer to play audio and video files linked within a document. A linked media file formatted as an HLS (HTTP Live Streaming) playlist—a protocol for streaming audio and video over HTTP—can force GStreamer to read local files and remote URLs during the document loading process. This can result in the contents of those local files or remote resources being incorporated into the document, leading to Local File Inclusion (LFI) and Server-Side Request Forgery (SSRF).

يؤدي فتح مستند يحتوي على روابط مصممة خصيصًا إلى إمكانية إنشاء روابط URL تقوم بتوسيع متغيرات البيئة أو قيم ملفات INI. يمكن أن يؤدي ذلك إلى تسريب معلومات حساسة إلى خادم بعيد. يستمر هذا الخلل في بيانات مثيل XForms ومزودي بيانات csv و sql في Calc، والتي لا تزال تسمح بتوسيع روابط URL ذات المخططات الداخلية عندما يتم توفير الرابط من المستند.

LibreOffice Calc allows linking a cell range to an external data source, with the link saved within the document. An attacker can specify a Java database driver to be loaded from a remote location via the `calcext:data-mappings` mechanism, the SQL provider, and the JDBC connector. When the document is opened, the application may execute Java code from that remote class path URL, leading to remote code execution.

A stack buffer overflow occurs during the conversion of CFF fonts to Type 1 fonts, a process that takes place when a document is exported to PDF and CFF fonts are embedded. The issue arises because converted operators are written into a fixed-size buffer without verifying if they fit, allowing a glyph that emits numerous operators to write beyond the buffer boundary.

An out of bounds read occurs during the import of PICT images, which can be embedded in documents. The issue arises when importing an image that utilizes a colour palette, as the palette index within the image data is used without being verified against the total number of palette entries. This allows an index exceeding the last entry to read memory outside the allocated palette.

An issue exists when importing WMF (Windows Metafile) graphics embedded in documents. A heap buffer overflow occurs during the import of a text record that includes its own character advance widths. This happens because the count of advance values and the text length are read separately from the file without validation to ensure they agree. Consequently, drawing the text can cause the process to read past the end of the advance array if the array is shorter than the text length.

A heap buffer overflow occurs during the import of encrypted PDF documents. The issue arises because the software uses the decryption key length specified in the document's encryption dictionary to fill a fixed-size key buffer without verifying if the length exceeds the buffer's capacity. This allows data to be written beyond the buffer's boundary. A heap buffer overflow is a memory corruption issue where a program writes more data to a heap-allocated memory block than it can hold.

An issue exists when importing PDF documents where a heap buffer overflow occurs during the processing of a stream object. The software uses the stream length specified in the object's own dictionary without verifying it against the actual number of bytes present. This leads to a condition where copying the stream reads and writes data beyond the allocated buffer boundary. A heap buffer overflow is a memory corruption error that occurs when a program writes more data to a heap-allocated buffer than it can hold.

An issue exists when reading CFF (Compact Font Format) fonts that may be embedded in documents. A stack buffer overflow occurs during the processing of glyph hints because the number of hints is validated against an incorrect bound. This allows a glyph that declares more hints than the allocated array can hold to write data past the end of the buffer.

URLs can be constructed to expand environment variable or INI file values, allowing potentially sensitive information to be exfiltrated to a remote server when a document containing such links is opened. This occurs because the check for the package content provider does not recognize all naming variations, allowing certain URLs to bypass the check and trigger the expansion.

يحدث تجاوز سعة مخزن الذاكرة المؤقتة (heap buffer overflow) أثناء استيراد رسومات EMF+، والتي يمكن تضمينها في المستندات. وعلى وجه التحديد، تظهر المشكلة عند استيراد فرشاة تدرج لوني بتنسيق EMF+. يقوم البرنامج بقراءة عدد نقاط مزج التدرج من الملف لحساب حجم التخصيص؛ ومع ذلك، قد يؤدي هذا الضرب إلى حدوث تجاوز سعة المخزن المؤقت. وينتج عن ذلك تخصيص مخزن مؤقت صغير جدًّا، يتم ملؤه بعد ذلك كما لو كان أكبر، مما يؤدي إلى كتابة البيانات خارج نطاق نهاية المخزن المؤقت.

The issue allows remote attackers to cause a denial of service via crafted files, including odt, ODG, wmf, and xls files, which can lead to a NULL pointer dereference. This is related to errors in number processing within multiple components of the OpenOffice.org module in the LibreOffice office program suite.