Re: CVE-2012-4233: multiple null pointer dereference flaws in LibreOffice/OpenOffice.org

[Marcus Meissner <meissner () suse de>]

On Thu, Nov 01, 2012 at 02:44:23PM -0600, Vincent Danen wrote:
> This one took me a bit by surprise.  Debian released an advisory for OOo
> and I have no record of this CVE anywhere.  It looks as though it went
> public yesterday, and was fixed in upstream 3.5.7.2, but it's not noted
> on the LibreOffice web site at all.
>
> Does anyone have any further details on these issues?  I just filed a
> bug in our bugzilla (https://bugzilla.redhat.com/show_bug.cgi?id=872350)
> with the following description/references which are all I've been able
> to find so far.
>
> I'm not sure on the commit referenced as [4] below; that was the first
> one that caught my eye, but I think it might be a red herring as it
> doesn't seem to be relevant to any of the file types that are noted as
> affected.
>
> Any further information anyone has would be sincerely appreciated.


I am not sure I am allowed to forward the quoted tdf-security mail
that lists the LibreOffice commits.

But it has in its mailheader:
From:     Caolán McNamara <caolanm () redhat com>
perhaps he can share the details (and I wonder why this caught redhat
by surprise then);

(The whole OpenOffice/LibreOffice security issue handling is not really
good ... long embargoes that get extended wildly even though fixes are in
public GIT already, etc )

Ciao, Marcus