Chris Evans discovered that the RTF import function in AbiWord is
vulnerable to a stack-based buffer overflow.
Impact
======
An attacker could design a malicious RTF file and entice the user to
import it in AbiWord, potentially resulting in the execution of
arbitrary code with the rights of the user running AbiWord.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All AbiWord users should upgrade to the latest version:
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security (at) gentoo (dot) org [email concealed] or alternatively, you may file a bug at
http://bugs.gentoo.org.
License
=======
Copyright 2005 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
Gentoo Linux Security Advisory GLSA 200509-20
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal
Title: AbiWord: RTF import stack-based buffer overflow
Date: September 30, 2005
Bugs: #107351
ID: 200509-20
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
AbiWord is vulnerable to a stack-based buffer overflow during RTF
import, making it vulnerable to the execution of arbitrary code.
Background
==========
AbiWord is a free and cross-platform word processing program. It allows
to import RTF files into AbiWord documents.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 app-office/abiword < 2.2.10 >= 2.2.10
Description
===========
Chris Evans discovered that the RTF import function in AbiWord is
vulnerable to a stack-based buffer overflow.
Impact
======
An attacker could design a malicious RTF file and entice the user to
import it in AbiWord, potentially resulting in the execution of
arbitrary code with the rights of the user running AbiWord.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All AbiWord users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=app-office/abiword-2.2.10"
References
==========
[ 1 ] CAN-2005-2964
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2964
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-200509-20.xml
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security (at) gentoo (dot) org [email concealed] or alternatively, you may file a bug at
http://bugs.gentoo.org.
License
=======
Copyright 2005 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.0
[ reply ]