CVE-2007-0002

描述

Multiple heap-based buffer overflows in WordPerfect Document importer/exporter (libwpd) before 0.8.9 allow user-assisted remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted WordPerfect file in which values to loop counters are not properly handled in the (1) WP3TablesGroup::_readContents and (2) WP5DefinitionGroup_DefineTablesSubGroup::WP5DefinitionGroup_DefineTablesSubGroup functions. NOTE: the integer overflow has been split into CVE-2007-1466.

如何修補 CVE-2007-0002

要修補 CVE-2007-0002,請將受影響套件升級到下列已修補版本。

• —升級至 0.8.9-1 或更新版本
• —升級至 0.8.1-1sarge1 或更新版本
• —升級至 1.1.3-9sarge6 或更新版本

CVE-2007-0002 正在被利用嗎?

中等 — EPSS 為 6.7%,可持續追蹤但非最高優先。

受影響套件(3)

• from 0, < 0.8.9-1
• from 0, < 0.8.1-1sarge1
• from 0, < 1.1.3-9sarge6

參考連結(1)

• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2007-0002