Redland Raptor (aka libraptor) before 2.0.7, as used by OpenOffice 3.3 and 3.4 Beta, LibreOffice before 3.4.6 and 3.5.x before 3.5.1, and other products, allows user-assisted remote attackers to read arbitrary files via a crafted XML external entity (XXE) declaration and reference in an RDF document.
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Raptor | Librdf | * | 2.0.7 (excluding) |
| Red Hat Enterprise Linux 5 | RedHat | openoffice.org-1:3.1.1-19.10.el5_8.1 | * |
| Red Hat Enterprise Linux 6 | RedHat | raptor-0:1.4.18-5.el6_2.1 | * |
| Libreoffice | Ubuntu | upstream | * |
| Openoffice.org | Ubuntu | hardy | * |
| Openoffice.org | Ubuntu | maverick | * |
| Raptor | Ubuntu | hardy | * |
| Raptor | Ubuntu | lucid | * |
| Raptor | Ubuntu | maverick | * |
| Raptor | Ubuntu | natty | * |
| Raptor | Ubuntu | oneiric | * |
| Raptor | Ubuntu | precise | * |
| Raptor | Ubuntu | quantal | * |
| Raptor | Ubuntu | upstream | * |
| Raptor2 | Ubuntu | precise | * |
| Raptor2 | Ubuntu | upstream | * |