CVE-2012-0037: apache openoffice

CVSS: 6.5v3.1MediumModified

AliasesRHSA-2012:0410RHSA-2012:0411DSA-2438-1

Published 17-06-2012Last modified 06-08-2024

Vulnerability summary

CVE-2012-0037 is a medium (CVSS 6.5) vulnerability in apache openoffice. EPSS estimates a 13.68% chance of exploitation in the next 30 days, higher than 96.4% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk

39/100

0100

Medium · default modelHow is this calculated?

CVSS score

6.5/10

010

Medium · v3.1 (NVD)

EPSS score

13.68%

0%100%

Medium · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits1reference

Timeline

17-06-2012
PublishedVulnerability first disclosed.
06-08-2024
Last modifiedVulnerability information updated.

Description

Redland Raptor (aka libraptor) before 2.0.7, as used by OpenOffice 3.3 and 3.4 Beta, LibreOffice before 3.4.6 and 3.5.x before 3.5.1, and other products, allows user-assisted remote attackers to read arbitrary files via a crafted XML external entity (XXE) declaration and reference in an RDF document.

CVSS metrics

2 scores · 1 source · 2 versions

v3.16.5v2.04.3

EPSS trend

Probability

13.68%

Chance of exploitation in the next 30 days

Percentile

96%

Versus all other CVEs

30-day change

0.00 pp

From 13.68% on 18-09-2026

18-09-202618-10-2026

EPSS score

13.68%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found

referenceUnverified
Exploit Reference (openwall.com)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-611Improper Restriction of XML External Entity ReferenceThe product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

Affected systems

Redhat90 products

gluster_storage_server_for_on-premise2.0
storage2.0
storage_for_public_cloud2.0
openoffice.org< 1:3.1.1-19.10.el5_8.1
openoffice.org-base< 1:3.1.1-19.10.el5_8.1
openoffice.org-calc< 1:3.1.1-19.10.el5_8.1
openoffice.org-core< 1:3.1.1-19.10.el5_8.1
openoffice.org-debuginfo< 1:3.1.1-19.10.el5_8.1
openoffice.org-draw< 1:3.1.1-19.10.el5_8.1
openoffice.org-emailmerge< 1:3.1.1-19.10.el5_8.1
openoffice.org-graphicfilter< 1:3.1.1-19.10.el5_8.1
openoffice.org-headless< 1:3.1.1-19.10.el5_8.1
openoffice.org-impress< 1:3.1.1-19.10.el5_8.1
openoffice.org-javafilter< 1:3.1.1-19.10.el5_8.1
openoffice.org-langpack-af_ZA< 1:3.1.1-19.10.el5_8.1
openoffice.org-langpack-ar< 1:3.1.1-19.10.el5_8.1
openoffice.org-langpack-as_IN< 1:3.1.1-19.10.el5_8.1
openoffice.org-langpack-bg_BG< 1:3.1.1-19.10.el5_8.1
openoffice.org-langpack-bn< 1:3.1.1-19.10.el5_8.1
openoffice.org-langpack-ca_ES< 1:3.1.1-19.10.el5_8.1
openoffice.org-langpack-cs_CZ< 1:3.1.1-19.10.el5_8.1
openoffice.org-langpack-cy_GB< 1:3.1.1-19.10.el5_8.1
openoffice.org-langpack-da_DK< 1:3.1.1-19.10.el5_8.1
openoffice.org-langpack-de< 1:3.1.1-19.10.el5_8.1
openoffice.org-langpack-el_GR< 1:3.1.1-19.10.el5_8.1
openoffice.org-langpack-es< 1:3.1.1-19.10.el5_8.1
openoffice.org-langpack-et_EE< 1:3.1.1-19.10.el5_8.1
openoffice.org-langpack-eu_ES< 1:3.1.1-19.10.el5_8.1
openoffice.org-langpack-fi_FI< 1:3.1.1-19.10.el5_8.1
openoffice.org-langpack-fr< 1:3.1.1-19.10.el5_8.1
openoffice.org-langpack-ga_IE< 1:3.1.1-19.10.el5_8.1
openoffice.org-langpack-gl_ES< 1:3.1.1-19.10.el5_8.1
openoffice.org-langpack-gu_IN< 1:3.1.1-19.10.el5_8.1
openoffice.org-langpack-he_IL< 1:3.1.1-19.10.el5_8.1
openoffice.org-langpack-hi_IN< 1:3.1.1-19.10.el5_8.1
openoffice.org-langpack-hr_HR< 1:3.1.1-19.10.el5_8.1
openoffice.org-langpack-hu_HU< 1:3.1.1-19.10.el5_8.1
openoffice.org-langpack-it< 1:3.1.1-19.10.el5_8.1
openoffice.org-langpack-ja_JP< 1:3.1.1-19.10.el5_8.1
openoffice.org-langpack-kn_IN< 1:3.1.1-19.10.el5_8.1
openoffice.org-langpack-ko_KR< 1:3.1.1-19.10.el5_8.1
openoffice.org-langpack-lt_LT< 1:3.1.1-19.10.el5_8.1
openoffice.org-langpack-ml_IN< 1:3.1.1-19.10.el5_8.1
openoffice.org-langpack-mr_IN< 1:3.1.1-19.10.el5_8.1
openoffice.org-langpack-ms_MY< 1:3.1.1-19.10.el5_8.1
openoffice.org-langpack-nb_NO< 1:3.1.1-19.10.el5_8.1
openoffice.org-langpack-nl< 1:3.1.1-19.10.el5_8.1
openoffice.org-langpack-nn_NO< 1:3.1.1-19.10.el5_8.1
openoffice.org-langpack-nr_ZA< 1:3.1.1-19.10.el5_8.1
openoffice.org-langpack-nso_ZA< 1:3.1.1-19.10.el5_8.1
openoffice.org-langpack-or_IN< 1:3.1.1-19.10.el5_8.1
openoffice.org-langpack-pa_IN< 1:3.1.1-19.10.el5_8.1
openoffice.org-langpack-pl_PL< 1:3.1.1-19.10.el5_8.1
openoffice.org-langpack-pt_BR< 1:3.1.1-19.10.el5_8.1
openoffice.org-langpack-pt_PT< 1:3.1.1-19.10.el5_8.1
openoffice.org-langpack-ru< 1:3.1.1-19.10.el5_8.1
openoffice.org-langpack-sk_SK< 1:3.1.1-19.10.el5_8.1
openoffice.org-langpack-sl_SI< 1:3.1.1-19.10.el5_8.1
openoffice.org-langpack-sr_CS< 1:3.1.1-19.10.el5_8.1
openoffice.org-langpack-ss_ZA< 1:3.1.1-19.10.el5_8.1
openoffice.org-langpack-st_ZA< 1:3.1.1-19.10.el5_8.1
openoffice.org-langpack-sv< 1:3.1.1-19.10.el5_8.1
openoffice.org-langpack-ta_IN< 1:3.1.1-19.10.el5_8.1
openoffice.org-langpack-te_IN< 1:3.1.1-19.10.el5_8.1
openoffice.org-langpack-th_TH< 1:3.1.1-19.10.el5_8.1
openoffice.org-langpack-tn_ZA< 1:3.1.1-19.10.el5_8.1
openoffice.org-langpack-tr_TR< 1:3.1.1-19.10.el5_8.1
openoffice.org-langpack-ts_ZA< 1:3.1.1-19.10.el5_8.1
openoffice.org-langpack-ur< 1:3.1.1-19.10.el5_8.1
openoffice.org-langpack-ve_ZA< 1:3.1.1-19.10.el5_8.1
openoffice.org-langpack-xh_ZA< 1:3.1.1-19.10.el5_8.1
openoffice.org-langpack-zh_CN< 1:3.1.1-19.10.el5_8.1
openoffice.org-langpack-zh_TW< 1:3.1.1-19.10.el5_8.1
openoffice.org-langpack-zu_ZA< 1:3.1.1-19.10.el5_8.1
openoffice.org-math< 1:3.1.1-19.10.el5_8.1
openoffice.org-pyuno< 1:3.1.1-19.10.el5_8.1
openoffice.org-sdk< 1:3.1.1-19.10.el5_8.1
openoffice.org-sdk-doc< 1:3.1.1-19.10.el5_8.1
openoffice.org-testtools< 1:3.1.1-19.10.el5_8.1
openoffice.org-ure< 1:3.1.1-19.10.el5_8.1
openoffice.org-writer< 1:3.1.1-19.10.el5_8.1
openoffice.org-xsltfilter< 1:3.1.1-19.10.el5_8.1
raptor< 0:1.4.18-5.el6_2.1
raptor-debuginfo< 0:1.4.18-5.el6_2.1
raptor-devel< 0:1.4.18-5.el6_2.1

Show all 90

Debian2 products

raptor< 1.4.21-2+squeeze1
debian_linuxEOL6.0

Apache1 product

openoffice3.3.0 | 3.4.0:beta

Fedoraproject1 product

fedoraEOL16 | 17

Librdf1 product

raptor< 2.0.7

Libreoffice1 product

libreoffice< 3.4.6 | 3.5.0

6 vendors · 96 products

References

40 links

secunia.com/advisories/60799Third Party AdvisoryX Refsource SECUNIABroken Link
secunia.com/advisories/48526Third Party AdvisoryX Refsource SECUNIABroken LinkVendor Advisory
secunia.com/advisories/48479Third Party AdvisoryX Refsource SECUNIABroken LinkVendor Advisory
www.gentoo.org/security/en/glsa/glsa-201408-19.xmlVendor AdvisoryX Refsource GENTOOThird Party Advisory
security.gentoo.org/glsa/glsa-201209-05.xmlVendor AdvisoryX Refsource GENTOOThird Party Advisory
secunia.com/advisories/48494Third Party AdvisoryX Refsource SECUNIABroken Link
www.securitytracker.com/id?1026837VDB EntryX Refsource SECTRACKBroken LinkThird Party Advisory
www.mandriva.com/security/advisories?name=MDVSA-2012:061Vendor AdvisoryX Refsource MANDRIVABroken Link
www.securityfocus.com/bid/52681VDB EntryX Refsource BIDBroken LinkThird Party Advisory
lists.fedoraproject.org/pipermail/package-announce/2012-April/078242.htmlVendor AdvisoryX Refsource FEDORAMailing List

Show all 40 references

secunia.com/advisories/48529Third Party AdvisoryX Refsource SECUNIABroken LinkVendor Advisory
www.osvdb.org/80307VDB EntryX Refsource OSVDBBroken Link
rhn.redhat.com/errata/RHSA-2012-0410.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
www.openwall.com/lists/oss-security/2012/03/27/4Mailing ListX Refsource MLISTExploit
www.mandriva.com/security/advisories?name=MDVSA-2012:062Vendor AdvisoryX Refsource MANDRIVABroken Link
secunia.com/advisories/48542Third Party AdvisoryX Refsource SECUNIABroken LinkVendor Advisory
www.libreoffice.org/advisories/CVE-2012-0037/X Refsource CONFIRMVendor AdvisoryARTICLE
vsecurity.com/resources/advisory/20120324-1/X Refsource MISCBroken LinkARTICLE
secunia.com/advisories/50692Third Party AdvisoryX Refsource SECUNIABroken Link
blog.documentfoundation.org/2012/03/22/tdf-announces-libreoffice-3-4-6/X Refsource CONFIRMRelease Notes
secunia.com/advisories/48649Third Party AdvisoryX Refsource SECUNIABroken Link
exchange.xforce.ibmcloud.com/vulnerabilities/74235VDB EntryX Refsource XFThird Party Advisory
www.debian.org/security/2012/dsa-2438Vendor AdvisoryX Refsource DEBIANThird Party Advisory
rhn.redhat.com/errata/RHSA-2012-0411.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
secunia.com/advisories/48493Third Party AdvisoryX Refsource SECUNIABroken LinkVendor Advisory
lists.fedoraproject.org/pipermail/package-announce/2012-April/077708.htmlVendor AdvisoryX Refsource FEDORAMailing List
www.mandriva.com/security/advisories?name=MDVSA-2012:063Vendor AdvisoryX Refsource MANDRIVABroken Link
www.openoffice.org/security/cves/CVE-2012-0037.htmlX Refsource CONFIRMMitigationPatchARTICLE
librdf.org/raptor/RELEASE.htmlX Refsource CONFIRMRelease Notes
github.com/dajobe/raptor/commit/a676f235309a59d4aa78eeffd2574ae5d341fcb0X Refsource CONFIRMPatch
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTPatch
access.redhat.com/errata/RHSA-2012:0410Advisory
access.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=791296REPORT
security.access.redhat.com/data/csaf/v2/advisories/2012/rhsa-2012_0410.jsonAdvisory
access.redhat.com/security/cve/CVE-2012-0037REPORT
www.cve.org/CVERecord?id=CVE-2012-0037Advisory
nvd.nist.gov/vuln/detail/CVE-2012-0037Advisory
access.redhat.com/errata/RHSA-2012:0411Advisory
security.access.redhat.com/data/csaf/v2/advisories/2012/rhsa-2012_0411.jsonAdvisory

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities