CVE-2012-2665 describes multiple heap-based buffer overflows in OpenOffice.org and LibreOffice versions prior to 3.5.5, affecting their XML manifest encryption tag parsing. This vulnerability, stemming from malformed Open Document Text (.odt) files, could allow remote attackers to trigger a denial of service or potentially execute arbitrary code. With a CVSS score of 7.5, it is considered highly severe due to its network-based attack vector and low attack complexity, leading to potential confidentiality, integrity, and availability impacts. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 3.4.1CPE matchmatch criteria | cpe:2.3:a:apache:openoffice:*:*:*:*:*:*:*:* | ||
< 3.5.5CPE matchmatch criteria | cpe:2.3:a:libreoffice:libreoffice:*:*:*:*:*:*:*:* | ||
10.04CPE matchmatch criteria | cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:-:*:*:* | ||
11.04CPE matchmatch criteria | cpe:2.3:o:canonical:ubuntu_linux:11.04:*:*:*:*:*:*:* | ||
11.10CPE matchmatch criteria | cpe:2.3:o:canonical:ubuntu_linux:11.10:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:L/Au:N/C:P/I:P/A:P
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
libreoffice: Multiple heap-based buffer overflows in the XML manifest encryption handling code
Aug 1, 2012Multiple heap-based buffer overflows in the XML manifest encryption handling code
Multiple heap-based buffer overflows in the XML manifest encryption handling code
Manifest-processing errors in Apache OpenOffice 3.4.0
Manifest-processing errors in Apache OpenOffice 3.4.0
Manifest-processing errors in Apache OpenOffice 3.4.0
Manifest-processing errors in Apache OpenOffice 3.4.0