Re: [Officesecurity] CVE Request (minor) -- LibreOffice (X >= v3.5.0): DoS (excessive CPU use) in the RTF tokenizer

[Caolán McNamara <caolanm () redhat com>]

On Thu, 2012-04-19 at 14:14 +0200, Jan Lieskovsky wrote:
> Though Caolán , Miklos or LibreOffice upstream can clarify further if
> this should be considered to be a security flaw (due to internal
> implementation details I am not aware of and might lead to memory
> corruption announced at [7]).

nah, insta-crash with a -1 passed to new(...) so throws bad_alloc,
"safe" crash.

> But as noted earlier, I don't think this is a security flaw, which
> should get a CVE identifier.

indeed.

> [8] https://bugs.freedesktop.org/show_bug.cgi?id=48640#c1 ('DoS PoC')
>
> This one (on LibreOffice >= v.3.5.0 using the new RTF tokenizer implementation)
> truly leads to denial of service (excessive CPU consumption and hang) while
> trying to process that RTF file. So this case might be applicable
> for CVE-2012-* identifier assignment.

Dunno about this, I mean if we're going to go around assigning CVEs to
every busy-hang we'd be knee deep in CVEs by the end of a week.

C.