Denial of Service Vulnerability in libwpd: Heap-Based Buffer Over-Read
Summary
CVE-2017-14226: WP1StylesListener.cpp, WP5StylesListener.cpp, and WP42StylesListener.cpp in libwpd 0.10.1 mishandle iterators, which allows remote attackers to cause a denial of service (heap-based buffer over-read in the WPXTableList c... Affects libwpd across 2 version ranges.
< 0.10.2-1
< 6c1e146422e0208259a459e850eb2948256953ff
Fixed in 0.10.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libwpd is an open-source library designed for reading and writing WordPerfect documents. It is widely used in various applications, including LibreOffice, to facilitate compatibility with WordPerfect files. The library's functionality includes parsing document structures and managing styles, which are critical for rendering documents accurately. However, certain versions of libwpd are susceptible to a vulnerability that can lead to denial of service, particularly in applications that utilize this library.
Vulnerability Detail
The vulnerability identified as CVE-2017-14226 arises from improper handling of iterators in the WP1StylesListener.cpp, WP5StylesListener.cpp, and WP42StylesListener.cpp files within libwpd version 0.10.1. This flaw allows remote attackers to exploit the WPXTableList class in WPXTable.cpp, resulting in a heap-based buffer over-read. Such an attack can lead to a denial of service in LibreOffice versions prior to 5.3.7, potentially causing the application to crash or become unresponsive.
How To Fix
Minimum fixed version
0.10.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libwpdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate upgrade is not feasible, users can mitigate the risk by avoiding the opening of potentially malicious WordPerfect documents until the library is updated. Additionally, implementing network security measures to restrict access to untrusted sources may help reduce exposure to this vulnerability.
Conclusion
CVE-2017-14226 is a significant vulnerability in libwpd that can lead to denial of service in applications like LibreOffice. Users are strongly advised to upgrade to the latest version of the library to mitigate risks. For those unable to upgrade immediately, implementing workarounds can help reduce exposure to potential attacks.
See every vulnerability recorded for libwpd →
FAQ
CVE-2017-14226 is a vulnerability in libwpd that allows remote attackers to cause a denial of service through a heap-based buffer over-read.
libwpd versions prior to 0.10.2-1 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of CVE-2017-14226 is 7.5, indicating a high severity level.
If an upgrade is not possible, avoid opening untrusted WordPerfect documents and consider implementing network security measures to limit exposure.
References
Related vulnerabilities
Recent vulnerabilities recorded for libwpd.
