Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×
libwpd: NULL pointer dereference in the function WP6ContentListener::defineTable in WP6ContentListener.cpp (CVE-2018-19208) SL7 x86_64 libwpd-0.10.0-2.el7.i686.rpm libwpd-0.10.0-2.el7.x86_64.rpm libwpd-doc-0.10.0-2.el7.noarch.rpm libwpd-devel-0.10.0-2.el7.i686.rpm libwpd-tools-0.10.0-2.el7.x86_64.rpm libwpd-devel-0.10.0-2.el7.x86_64.rpm libwpd-debuginfo-0.10.0-2. [More...]. Synopsis: Low: libwpd security update Advisory ID: SLSA-2019:2126-1 Issue Date: 2019-08-06 CVE Numbers: CVE-2018-19208 -- Security Fix(es): * libwpd: NULL pointer dereference in the function WP6ContentListener::defineTable in WP6ContentListener.cpp (CVE-2018-19208) -- SL7 x86_64 libwpd-0.10.0-2.el7.i686.rpm libwpd-0.10.0-2.el7.x86_64.rpm libwpd-doc-0.10.0-2.el7.noarch.rpm libwpd-devel-0.10.0-2.el7.i686.rpm libwpd-tools-0.10.0-2.el7.x86_64.rpm libwpd-devel-0.10.0-2.el7.x86_64.rpm libwpd-debuginfo-0.10.0-2.el7.i686.rpm libwpd-debuginfo-0.10.0-2.el7.x86_64.rpm noarch libwpd-doc-0.10.0-2.el7.noarch.rpm - Scientific Linux Development Team . Moderate risk libwps security patch for Scientific Linux resolves memory leak, impacting several RPM packages.. libwpd, low severity, security advisory, pointer issue, scientific linux. . Severity: Low. LinuxSecurity.com Team
An update for libwpd is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Low: libwpd security update Advisory ID: RHSA-2019:2126-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2019:2126 Issue date: 2019-08-06 CVE Names: CVE-2018-19208 ==================================================================== 1. Summary: An update for libwpd is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Client (v. 7) - x86_64 Red Hat Enterprise Linux Client Optional (v. 7) - noarch, x86_64 Red Hat Enterprise Linux ComputeNode Optional (v. 7) - noarch, x86_64 Red Hat Enterprise Linux Server (v. 7) - ppc64le, x86_64 Red Hat Enterprise Linux Server Optional (v. 7) - noarch, ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 7) - x86_64 Red Hat Enterprise Linux Workstation Optional (v. 7) - noarch, x86_64 3. Description: libwpd is a library for reading and converting Corel WordPerfect Office documents. Security Fix(es): * libwpd: NULL pointer dereference in the function WP6ContentListener::defineTable in WP6ContentListener.cpp (CVE-2018-19208) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in theReferences section. Additional Changes: For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes linked from the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1649414 - CVE-2018-19208 libwpd: NULL pointer dereference in the function WP6ContentListener::defineTable in WP6ContentListener.cpp 6. Package List: Red Hat Enterprise Linux Client (v. 7): Source: libwpd-0.10.0-2.el7.src.rpm x86_64: libwpd-0.10.0-2.el7.i686.rpm libwpd-0.10.0-2.el7.x86_64.rpm libwpd-debuginfo-0.10.0-2.el7.i686.rpm libwpd-debuginfo-0.10.0-2.el7.x86_64.rpm Red Hat Enterprise Linux Client Optional (v. 7): noarch: libwpd-doc-0.10.0-2.el7.noarch.rpm x86_64: libwpd-debuginfo-0.10.0-2.el7.i686.rpm libwpd-debuginfo-0.10.0-2.el7.x86_64.rpm libwpd-devel-0.10.0-2.el7.i686.rpm libwpd-devel-0.10.0-2.el7.x86_64.rpm libwpd-tools-0.10.0-2.el7.x86_64.rpm Red Hat Enterprise Linux ComputeNode Optional (v. 7): Source: libwpd-0.10.0-2.el7.src.rpm noarch: libwpd-doc-0.10.0-2.el7.noarch.rpm x86_64: libwpd-0.10.0-2.el7.i686.rpm libwpd-0.10.0-2.el7.x86_64.rpm libwpd-debuginfo-0.10.0-2.el7.i686.rpm libwpd-debuginfo-0.10.0-2.el7.x86_64.rpm libwpd-devel-0.10.0-2.el7.i686.rpm libwpd-devel-0.10.0-2.el7.x86_64.rpm libwpd-tools-0.10.0-2.el7.x86_64.rpm Red Hat Enterprise Linux Server (v. 7): Source: libwpd-0.10.0-2.el7.src.rpm ppc64le: libwpd-0.10.0-2.el7.ppc64le.rpm libwpd-debuginfo-0.10.0-2.el7.ppc64le.rpm x86_64: libwpd-0.10.0-2.el7.i686.rpm libwpd-0.10.0-2.el7.x86_64.rpm libwpd-debuginfo-0.10.0-2.el7.i686.rpm libwpd-debuginfo-0.10.0-2.el7.x86_64.rpm Red Hat Enterprise Linux Server Optional (v.7): Source: libwpd-0.10.0-2.el7.src.rpm noarch: libwpd-doc-0.10.0-2.el7.noarch.rpm ppc64: libwpd-0.10.0-2.el7.ppc.rpm libwpd-0.10.0-2.el7.ppc64.rpm libwpd-debuginfo-0.10.0-2.el7.ppc.rpm libwpd-debuginfo-0.10.0-2.el7.ppc64.rpm libwpd-devel-0.10.0-2.el7.ppc.rpm libwpd-devel-0.10.0-2.el7.ppc64.rpm libwpd-tools-0.10.0-2.el7.ppc64.rpm ppc64le: libwpd-debuginfo-0.10.0-2.el7.ppc64le.rpm libwpd-devel-0.10.0-2.el7.ppc64le.rpm libwpd-tools-0.10.0-2.el7.ppc64le.rpm s390x: libwpd-0.10.0-2.el7.s390.rpm libwpd-0.10.0-2.el7.s390x.rpm libwpd-debuginfo-0.10.0-2.el7.s390.rpm libwpd-debuginfo-0.10.0-2.el7.s390x.rpm libwpd-devel-0.10.0-2.el7.s390.rpm libwpd-devel-0.10.0-2.el7.s390x.rpm libwpd-tools-0.10.0-2.el7.s390x.rpm x86_64: libwpd-debuginfo-0.10.0-2.el7.i686.rpm libwpd-debuginfo-0.10.0-2.el7.x86_64.rpm libwpd-devel-0.10.0-2.el7.i686.rpm libwpd-devel-0.10.0-2.el7.x86_64.rpm libwpd-tools-0.10.0-2.el7.x86_64.rpm Red Hat Enterprise Linux Workstation (v. 7): Source: libwpd-0.10.0-2.el7.src.rpm x86_64: libwpd-0.10.0-2.el7.i686.rpm libwpd-0.10.0-2.el7.x86_64.rpm libwpd-debuginfo-0.10.0-2.el7.i686.rpm libwpd-debuginfo-0.10.0-2.el7.x86_64.rpm Red Hat Enterprise Linux Workstation Optional (v. 7): noarch: libwpd-doc-0.10.0-2.el7.noarch.rpm x86_64: libwpd-debuginfo-0.10.0-2.el7.i686.rpm libwpd-debuginfo-0.10.0-2.el7.x86_64.rpm libwpd-devel-0.10.0-2.el7.i686.rpm libwpd-devel-0.10.0-2.el7.x86_64.rpm libwpd-tools-0.10.0-2.el7.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2018-19208 https://access.redhat.com/security/updates/classification/#low https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.7_release_notes/index 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2019 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPGv1 iQIVAwUBXUl3sdzjgjWX9erEAQhjAA/7Blz8nXKXqu2QLL9oofyRQri+yIITzsU6 ZOkgaYemZ0hCRmiAafRH28xwyxe7W89gso3crNh5d46e6Jb3xAJrhmYd7rJJpWST k/ym7+t+1cWJdfDlaZ4i/uCwqbfdhrmrjutJCJr8qT9MfPGm3OJy0BNGojnv7IoW 3P7Y3CgeE6GzwxST4gNom1kqeNa64MWA1+pqPqTcuP9NZdw1p7baYwvLmMxNVCCL nYWQwkeFI0IjdL0hmecxEMfErts5XWtrbBVFJhHPJfLbP1UIFpxX5TF6rgJtZFG3 awAEpxtpD3Mh8NxFa6GO1u0Fv3oo97UIsm9ShMoBkAXO8CCALf7d57EMSviiXgwY YcJNijobXx2/ct9AUeAfM3Qp0jrt4y/7ZBszfCJn+9Y71v8DArRRIPfvmfrO0Zmd Wlt6zzyn5uufYDDBxFwTB7CmPu8qMaDBvSpNQEIxkpHGUW/BblCwM+sNaQl/Bn90 0/mViscnRAhC1wRkunQorM96VQDTFQqs+7ILUZ3mDKw3pqL7M+2mMCwFDtJpof7p i6RK3XxKVcWRlNrX5CSJ2xYcA74kFSHpCj7FOgVZcdZidHJ1h2NbF7quoqO7fuLW f7Q8MPEslZ6dRizhvWhw2uLmLXnff3XpH5vErfts3Cv/W76H3VSXJlmeDK51C8t5 iRQ1+Dyonvc=QnFJ -----END PGP SIGNATURE----- -- RHSA-announce mailing list
It was discovered there is a NULL pointer dereference in the function WP6ContentListener::defineTable in WP6ContentListener.cpp that will lead to a denial of service attack (CVE-2018-19208). References: . MGASA-2018-0481 - Updated libwpd packages fix security vulnerability Publication date: 15 Dec 2018 URL: https://advisories.mageia.org/MGASA-2018-0481.html Type: security Affected Mageia releases: 6 CVE: CVE-2018-19208 It was discovered there is a NULL pointer dereference in the function WP6ContentListener::defineTable in WP6ContentListener.cpp that will lead to a denial of service attack (CVE-2018-19208). References: - https://bugs.mageia.org/show_bug.cgi?id=23864 - http://lists.suse.com/pipermail/sle-security-updates/2018-November/004865.html - https://security-tracker.debian.org/tracker/CVE-2018-19208 - https://www.cve.org/CVERecord?id=CVE-2018-19208 SRPMS: - 6/core/libwpd-0.10.2-1.1.mga6 . A security patch for libwpg in Mageia resolves a critical NULL reference vulnerability resulting in potential service interruption. Released on 20 Nov 2020.. Mageia Security Update, libwpd Vulnerability, Denial Of Service, NULL Pointer Dereference, Vulnerability Management. . LinuxSecurity.com Team
An update that fixes one vulnerability is now available. . SUSE Security Update: Security update for libwpd ______________________________________________________________________________ Announcement ID: SUSE-SU-2018:3812-2 Rating: important References: #1115713 Cross-References: CVE-2018-19208 Affected Products: SUSE Linux Enterprise Workstation Extension 12-SP4 SUSE Linux Enterprise Software Development Kit 12-SP4 SUSE Linux Enterprise Desktop 12-SP4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libwpd fixes the following issues: Security issue fixed: - CVE-2018-19208: Fixed illegal address access inside libwpd at function WP6ContentListener:defineTable (bsc#1115713). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Workstation Extension 12-SP4: zypper in -t patch SUSE-SLE-WE-12-SP4-2018-2706=1 - SUSE Linux Enterprise Software Development Kit 12-SP4: zypper in -t patch SUSE-SLE-SDK-12-SP4-2018-2706=1 - SUSE Linux Enterprise Desktop 12-SP4: zypper in -t patch SUSE-SLE-DESKTOP-12-SP4-2018-2706=1 Package List: - SUSE Linux Enterprise Workstation Extension 12-SP4 (x86_64): libwpd-0_10-10-0.10.2-2.7.1 libwpd-0_10-10-debuginfo-0.10.2-2.7.1 libwpd-debugsource-0.10.2-2.7.1 - SUSE Linux Enterprise Software Development Kit 12-SP4 (aarch64 ppc64le s390x x86_64): libwpd-0_10-10-0.10.2-2.7.1 libwpd-0_10-10-debuginfo-0.10.2-2.7.1 libwpd-debugsource-0.10.2-2.7.1 libwpd-devel-0.10.2-2.7.1 - SUSE Linux Enterprise Software Development Kit 12-SP4 (noarch): libwpd-devel-doc-0.10.2-2.7.1 - SUSE LinuxEnterprise Desktop 12-SP4 (x86_64): libwpd-0_10-10-0.10.2-2.7.1 libwpd-0_10-10-debuginfo-0.10.2-2.7.1 libwpd-debugsource-0.10.2-2.7.1 References: https://www.suse.com/security/cve/CVE-2018-19208.html https://bugzilla.suse.com/1115713 _______________________________________________ sle-security-updates mailing list
An update that fixes one vulnerability is now available.. openSUSE Security Update: Security update for libwpd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3886-1 Rating: important References: #1115713 Cross-References: CVE-2018-19208 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libwpd fixes the following issues: Security issue fixed: - CVE-2018-19208: illegal address access inside libwpd at function WP6ContentListener:defineTable (bsc#1115713). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1463=1 Package List: - openSUSE Leap 15.0 (noarch): libwpd-devel-doc-0.10.2-lp150.2.3.1 - openSUSE Leap 15.0 (x86_64): libwpd-0_10-10-0.10.2-lp150.2.3.1 libwpd-0_10-10-debuginfo-0.10.2-lp150.2.3.1 libwpd-debuginfo-0.10.2-lp150.2.3.1 libwpd-debugsource-0.10.2-lp150.2.3.1 libwpd-devel-0.10.2-lp150.2.3.1 libwpd-tools-0.10.2-lp150.2.3.1 libwpd-tools-debuginfo-0.10.2-lp150.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-19208.html https://bugzilla.suse.com/1115713 -- . The latest openSUSE update for libwpd addresses a critical vulnerability related to unauthorized memory access; detailed installation guidelines included.. openSUSE Update, libwpd Fix, Security Patch. . Severity: Important. LinuxSecurity.com Team
An update that fixes one vulnerability is now available. . SUSE Security Update: Security update for libwpd ______________________________________________________________________________ Announcement ID: SUSE-SU-2018:3870-1 Rating: important References: #1115713 Cross-References: CVE-2018-19208 Affected Products: SUSE Linux Enterprise Workstation Extension 15 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libwpd fixes the following issues: Security issue fixed: - CVE-2018-19208: Fixed illegal address access inside libwpd at function WP6ContentListener:defineTable (bsc#1115713). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Workstation Extension 15: zypper in -t patch SUSE-SLE-Product-WE-15-2018-2761=1 - SUSE Linux Enterprise Module for Open Buildservice Development Tools 15: zypper in -t patch SUSE-SLE-Module-Development-Tools-OBS-15-2018-2761=1 Package List: - SUSE Linux Enterprise Workstation Extension 15 (x86_64): libwpd-0_10-10-0.10.2-3.3.1 libwpd-0_10-10-debuginfo-0.10.2-3.3.1 libwpd-debuginfo-0.10.2-3.3.1 libwpd-debugsource-0.10.2-3.3.1 libwpd-devel-0.10.2-3.3.1 - SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 (aarch64 ppc64le s390x x86_64): libwpd-debuginfo-0.10.2-3.3.1 libwpd-debugsource-0.10.2-3.3.1 libwpd-tools-0.10.2-3.3.1 libwpd-tools-debuginfo-0.10.2-3.3.1 - SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 (noarch): libwpd-devel-doc-0.10.2-3.3.1 References: https://www.suse.com/security/cve/CVE-2018-19208.html https://bugzilla.suse.com/1115713 _______________________________________________ sle-security-updates mailing list
An update that fixes one vulnerability is now available.. openSUSE Security Update: Security update for libwpd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:3842-1 Rating: important References: #1115713 Cross-References: CVE-2018-19208 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libwpd fixes the following issues: Security issue fixed: - CVE-2018-19208: Fixed illegal address access inside libwpd at function WP6ContentListener:defineTable (bsc#1115713). This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-1440=1 Package List: - openSUSE Leap 42.3 (x86_64): libwpd-0_10-10-0.10.2-11.1 libwpd-0_10-10-debuginfo-0.10.2-11.1 libwpd-debugsource-0.10.2-11.1 libwpd-devel-0.10.2-11.1 libwpd-tools-0.10.2-11.1 libwpd-tools-debuginfo-0.10.2-11.1 - openSUSE Leap 42.3 (noarch): libwpd-devel-doc-0.10.2-11.1 References: https://www.suse.com/security/cve/CVE-2018-19208.html https://bugzilla.suse.com/1115713 -- . A crucial announcement for openSUSE Leap 42.3 tackles a vulnerability in libexiv2, bolstering the system's defenses.. openSUSE Leap Patch, libwpd Security Update, Important Linux Update. . Severity: Important. LinuxSecurity.com Team
An update that fixes one vulnerability is now available. . SUSE Security Update: Security update for libwpd ______________________________________________________________________________ Announcement ID: SUSE-SU-2018:3812-1 Rating: important References: #1115713 Cross-References: CVE-2018-19208 Affected Products: SUSE Linux Enterprise Workstation Extension 12-SP3 SUSE Linux Enterprise Software Development Kit 12-SP3 SUSE Linux Enterprise Desktop 12-SP3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libwpd fixes the following issues: Security issue fixed: - CVE-2018-19208: Fixed illegal address access inside libwpd at function WP6ContentListener:defineTable (bsc#1115713). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Workstation Extension 12-SP3: zypper in -t patch SUSE-SLE-WE-12-SP3-2018-2706=1 - SUSE Linux Enterprise Software Development Kit 12-SP3: zypper in -t patch SUSE-SLE-SDK-12-SP3-2018-2706=1 - SUSE Linux Enterprise Desktop 12-SP3: zypper in -t patch SUSE-SLE-DESKTOP-12-SP3-2018-2706=1 Package List: - SUSE Linux Enterprise Workstation Extension 12-SP3 (x86_64): libwpd-0_10-10-0.10.2-2.7.1 libwpd-0_10-10-debuginfo-0.10.2-2.7.1 libwpd-debugsource-0.10.2-2.7.1 - SUSE Linux Enterprise Software Development Kit 12-SP3 (aarch64 ppc64le s390x x86_64): libwpd-0_10-10-0.10.2-2.7.1 libwpd-0_10-10-debuginfo-0.10.2-2.7.1 libwpd-debugsource-0.10.2-2.7.1 libwpd-devel-0.10.2-2.7.1 - SUSE Linux Enterprise Software Development Kit 12-SP3 (noarch): libwpd-devel-doc-0.10.2-2.7.1 - SUSE LinuxEnterprise Desktop 12-SP3 (x86_64): libwpd-0_10-10-0.10.2-2.7.1 libwpd-0_10-10-debuginfo-0.10.2-2.7.1 libwpd-debugsource-0.10.2-2.7.1 References: https://www.suse.com/security/cve/CVE-2018-19208.html https://bugzilla.suse.com/1115713 _______________________________________________ sle-security-updates mailing list
Get the latest Linux and open source security news straight to your inbox.