Vulnerable to the billion laughs attack

[David]

If one alters one of the various xml file formats that libreoffice supports(I tested against .docx and .odt - I assume the other formats are also vulnerable) and inserts the [0] billion laughs 'stock' xml attack into the document when libreoffice attempts to open the file then it will expand the entities (using 100% cpu and continuing to use more and more memory).
I will attach an example .odt file where the content.xml inside the zip container has been modified to this issue.

[0]http://en.wikipedia.org/wiki/Billion_laughs

[Marc Deslauriers (mdeslaur)]

Thanks for reporting this. Could you please report it to the upstream LibreOffice developers, and if applicable link the upstream bug here?

link is:
http://www.libreoffice.org/advisories/

Thanks!

[Jamie Strandboge (jdstrand)]

David, what was upstream's response?

[David (d--)]

Ah sorry I didn't notice you reply before :-) (It was this --> )

Caolán McNamara <email address hidden>
On Wed, 2012-04-11 at 23:01 +1000, David Black wrote:
> If one alters one of the various xml file formats that libreoffice
> supports(I tested against .docx and .odt - I assume the other formats
> are also vulnerable) and inserts the [0] billion laughs 'stock' xml
> attack into the document when libreoffice attempts to open the file
> then it will expand the entities (using 100% cpu and continuing to use
> more and more memory).

Rats, that's annoying. Oh well, we acknowledge receipt of this anyway,
and hopefully we can come up with some solutions soon.

[David (d--)]

According to upstream this issue was fixed in LibreOffice 3.5.5.

[Björn Michaelsen (bjoern-michaelsen)]

marking as a dupe of the 3.5.7 SRU for precise then.