Medium severity · published Jun 17, 2012
CVE-2012-0037
Redland Raptor (aka libraptor) before 2.0.7, as used by OpenOffice 3.3 and 3.4 Beta, LibreOffice before 3.4.6 and 3.5.x before 3.5.1, and other products, allows user-assisted…
6.5
CVSS
13.5%
EPSS
No
On KEV
Description
Redland Raptor (aka libraptor) before 2.0.7, as used by OpenOffice 3.3 and 3.4 Beta, LibreOffice before 3.4.6 and 3.5.x before 3.5.1, and other products, allows user-assisted remote attackers to read arbitrary files via a crafted XML external entity (XXE) declaration and reference in an RDF document.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)13.5% · higher than 96% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DL
Debian Linux · Debian
6.0 · source: NVD
EL
Enterprise Linux Desktop · Redhat
5.0; 6.0 · source: NVD
EL
Enterprise Linux Eus · Redhat
6.2 · source: NVD
EL
Enterprise Linux Server · Redhat
5.0; 6.0 · source: NVD
EL
Enterprise Linux Server Aus · Redhat
6.2 · source: NVD
EL
Enterprise Linux Workstation · Redhat
5.0; 6.0 · source: NVD
FE
Fedora · Fedoraproject
16; 17 · source: NVD
GS
Gluster Storage Server For On-premise · Redhat
2.0 · source: NVD
LI
Libreoffice · Libreoffice
before 3.4.6; 3.5.0 · source: NVD
OP
Openoffice · Apache
3.3.0; 3.4.0 · source: NVD
RA
Raptor · Librdf
before 2.0.7 · source: NVD
ST
Storage · Redhat
2.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-0037
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-0037
Release Notes
http://blog.documentfoundation.org/2012/03/22/tdf-announces-libreoffice-3-4-6/
Release Notes
http://librdf.org/raptor/RELEASE.html#rel2_0_7
Mailing List
http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077708.html
Mailing List
http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078242.html
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2012-0410.html
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2012-0411.html
More from Openoffice
8.8
CVE-2023-47804
Apache OpenOffice documents can contain links that call internal macros with arbitrary arguments
8.8
CVE-2022-37401
Apache OpenOffice supports the storage of passwords for web connections in the user's configuration database
8.8
CVE-2022-37400
Apache OpenOffice supports the storage of passwords for web connections in the user's configuration database
8.8
CVE-2021-30245
The project received a report that all versions of Apache OpenOffice through 4.1.8 can open non-http(s) hyperlinks
8.1
CVE-2025-64403
Apache OpenOffice Calc spreadsheet can contain links to other files, in the form of "external data sources"