http://bugzilla.opensuse.org/show_bug.cgi?id=1017682 Bug ID: 1017682 Summary: VUL-0: CVE-2016-10091: UnRTF: stack-based buffer overflows in cmd_* functions Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.2 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: KDE3 Assignee: anixx@opensuse.org Reporter: mikhail.kasimov@gmail.com QA Contact: qa-bugs@suse.de Found By: --- Blocker: --- Ref: http://seclists.org/oss-sec/2016/q4/786 =============================================== Hi As reported by "Skylake" in the Debian bugtracker[1], UnRTF is prone to stack-based buffer overflows in various cmd_* functions. I've found a Stack-based buffer overflow in unrtf 0.21.9, which affects three functions including: cmd_expand, cmd_emboss and cmd_engrave. # convert.c static int cmd_expand (Word *w, int align, char has_param, int param) { char str[10]; if (has_param) { sprintf(str, "%d", param/4); // Overflow, 9-digit negative value triggers the bug if (!param) attr_pop(ATTR_EXPAND); else attr_push(ATTR_EXPAND, str); } return FALSE; } Apparently writing a negative integer to the buffer can trigger the overflow (Minus sign needs an extra byte). * How to trigger the bug * $ echo "\expnd-400000000" > poc $ unrtf poc A preliminary patch can be found in the Debian bugtracker, but it is not yet finalized. Could you assign (a?) CVE as needed? Does one CVE suffice here, since same class of issue in various cmd_* functions from one reporter? Whilest, at least in Debian, unrtf is compiled with FORTIFY_SOURCE=2 and the buffer overflows are detected, at least if any exposed application uses unrtf to process untrusted input, this might lead to a denial-of-service. [1] https://bugs.debian.org/849705 Regards, Salvatore =============================================== https://software.opensuse.org/package/unrtf TW: KDE:KDE3: 0.21.5 42.2: KDE:Extra: 0.21.5 and KDE:KDE3: 0.21.8 42.1: KDE:Extra: 0.21.5 and KDE:KDE3: 0.21.8 13.2: KDE:Extra: 0.21.5 and KDE:KDE3: 0.21.8 -- You are receiving this mail because: You are on the CC list for the bug.