Caolán Mcnamara

A heap buffer overflow occurs when the dBASE database driver reads index files (.ndx) used as a data source. The issue arises because the number of entries recorded in a page is not validated against the maximum capacity defined in the index header. Additionally, a specially crafted index can cause a page to refer back to itself, leading to infinite recursion during the reading process.

LibreOffice Calc allows linking a cell range to an external data source, with the link being saved within the document. This mechanism can be abused to open an embedded Firebird database that enables writing a file to any location accessible to the user.

LibreOffice Calc allows linking a cell range to an external csv data source, with the link being saved within the document. Because these links are fetched during the document loading process, opening a malicious document can lead to Local File Inclusion (LFI), where a local file is read into the sheet, or Server-Side Request Forgery (SSRF), where a request is made to a host selected by the document creator. This occurs via `calcext:data-mappings` and the csv provider.

LibreOffice Calc allows linking a cell range to an external data source, with the link stored within the document. A link using the sql type can designate a folder containing local text files as a database. This allows an attacker to read local text files into a sheet when a document is opened. This is a Local File Inclusion (LFI) issue, where an application is tricked into exposing or executing files on the local system.

On Linux, the software uses GStreamer to play audio and video files linked within a document. A linked media file formatted as an HLS (HTTP Live Streaming) playlist—a protocol for streaming audio and video over HTTP—can force GStreamer to read local files and remote URLs during the document loading process. This can result in the contents of those local files or remote resources being incorporated into the document, leading to Local File Inclusion (LFI) and Server-Side Request Forgery (SSRF).

Opening a document containing specially crafted links allows the construction of URLs that expand environment variable or INI file values. This can lead to the exfiltration of sensitive information to a remote server. The issue persists in XForms instance data and the Calc csv and sql data providers, which still allow the expansion of URLs with internal schemes when supplied by a document.

LibreOffice Calc allows linking a cell range to an external data source, with the link saved within the document. An attacker can specify a Java database driver to be loaded from a remote location via the `calcext:data-mappings` mechanism, the SQL provider, and the JDBC connector. When the document is opened, the application may execute Java code from that remote class path URL, leading to remote code execution.

A stack buffer overflow occurs during the conversion of CFF fonts to Type 1 fonts, a process that takes place when a document is exported to PDF and CFF fonts are embedded. The issue arises because converted operators are written into a fixed-size buffer without verifying if they fit, allowing a glyph that emits numerous operators to write beyond the buffer boundary.

An out of bounds read occurs during the import of PICT images, which can be embedded in documents. The issue arises when importing an image that utilizes a colour palette, as the palette index within the image data is used without being verified against the total number of palette entries. This allows an index exceeding the last entry to read memory outside the allocated palette.

An issue exists when importing WMF (Windows Metafile) graphics embedded in documents. A heap buffer overflow occurs during the import of a text record that includes its own character advance widths. This happens because the count of advance values and the text length are read separately from the file without validation to ensure they agree. Consequently, drawing the text can cause the process to read past the end of the advance array if the array is shorter than the text length.

A heap buffer overflow occurs during the import of encrypted PDF documents. The issue arises because the software uses the decryption key length specified in the document's encryption dictionary to fill a fixed-size key buffer without verifying if the length exceeds the buffer's capacity. This allows data to be written beyond the buffer's boundary. A heap buffer overflow is a memory corruption issue where a program writes more data to a heap-allocated memory block than it can hold.

An issue exists when importing PDF documents where a heap buffer overflow occurs during the processing of a stream object. The software uses the stream length specified in the object's own dictionary without verifying it against the actual number of bytes present. This leads to a condition where copying the stream reads and writes data beyond the allocated buffer boundary. A heap buffer overflow is a memory corruption error that occurs when a program writes more data to a heap-allocated buffer than it can hold.

An issue exists when reading CFF (Compact Font Format) fonts that may be embedded in documents. A stack buffer overflow occurs during the processing of glyph hints because the number of hints is validated against an incorrect bound. This allows a glyph that declares more hints than the allocated array can hold to write data past the end of the buffer.

URLs can be constructed to expand environment variable or INI file values, allowing potentially sensitive information to be exfiltrated to a remote server when a document containing such links is opened. This occurs because the check for the package content provider does not recognize all naming variations, allowing certain URLs to bypass the check and trigger the expansion.

A heap buffer overflow occurs during the import of EMF+ graphics, which can be embedded in documents. Specifically, the issue arises when importing an EMF+ gradient brush. The software reads the number of gradient blend points from the file to calculate the allocation size; however, this multiplication can overflow. This results in the allocation of a buffer that is too small, which is then filled as if it were larger, leading to data being written past the end of the buffer.

The issue allows remote attackers to cause a denial of service via crafted files, including odt, ODG, wmf, and xls files, which can lead to a NULL pointer dereference. This is related to errors in number processing within multiple components of the OpenOffice.org module in the LibreOffice office program suite.