Description
Redland Raptor (aka libraptor) before 2.0.7, as used by OpenOffice 3.3 and 3.4 Beta, LibreOffice before 3.4.6 and 3.5.x before 3.5.1, and other products, allows user-assisted remote attackers to read arbitrary files via a crafted XML external entity (XXE) declaration and reference in an RDF document.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 6.0 | raptor | 1.4.21-2+squeeze1 | DSA-2438-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | raptor +1 | 1.4.18-5.el6_2.1 | RHSA-2012:0410 |
| RHEL 5 | openoffice.org +77 | 1:3.1.1-19.10.el5_8.1 | RHSA-2012:0411 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Productivity 5 | openoffice.org +77 | 1:3.1.1-19.10.el5_8.1 | RHSA-2012:0411 |
Advisories 3
- RHSA-2012:0411 Red Hat Security Advisory: openoffice.org security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2012:0410 Red Hat Security Advisory: raptor security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2438-1 raptor - programming error Debian Security (DSA / DLA) · Mar 9, 2026
References
- 60799 third-party-advisory
- 48526 third-party-advisory
- 48479 third-party-advisory
- GLSA-201408-19 vendor-advisory
- GLSA-201209-05 vendor-advisory
- 48494 third-party-advisory
- 1026837 vdb-entry
- MDVSA-2012:061 vendor-advisory
- 52681 vdb-entry
- FEDORA-2012-4663 vendor-advisory
- 48529 third-party-advisory
- 80307 vdb-entry
- RHSA-2012:0410 vendor-advisory
- [oss-security] 20120427 Fwd: CVE-2012-0037: libraptor - XXE in RDF/XML File Interpretation (Multiple office products affected) mailing-list
- MDVSA-2012:062 vendor-advisory
- 48542 third-party-advisory
- http://www.libreoffice.org/advisories/CVE-2012-0037/
- http://vsecurity.com/resources/advisory/20120324-1/
- 50692 third-party-advisory
- http://blog.documentfoundation.org/2012/03/22/tdf-announces-libreoffice-3-4-6/
- 48649 third-party-advisory
- openoffice-xml-info-disclosure(74235) vdb-entry
- DSA-2438 vendor-advisory
- RHSA-2012:0411 vendor-advisory
- 48493 third-party-advisory
- FEDORA-2012-4629 vendor-advisory
- MDVSA-2012:063 vendor-advisory
- http://www.openoffice.org/security/cves/CVE-2012-0037.html
- http://librdf.org/raptor/RELEASE.html#rel2_0_7
- https://github.com/dajobe/raptor/commit/a676f235309a59d4aa78eeffd2574ae5d341fcb0
- [openoffice-commits] 20200305 svn commit: r1874832 - in /openoffice/ooo-site/trunk/content: download/checksums.html download/globalvars.js download/test/globalvars.js security/cves/CVE-2012-0037.html security/cves/CVE-2013-1571.html mailing-list