Description
Antiword through 0.37 contains a stack out-of-bounds read vulnerability in vGet8PapInfo and vGet8ChrInfo in prop8.c because FKP run counts and grpprl offsets are not bounded. Attackers can supply a crafted .doc file with malicious FKP pages to read past the 512-byte stack buffer, crashing antiword or corrupting style parsing.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Adri van Os antiword
Default version status: unaffected
0 to ≤ 0.37affected
References
- https://hackmd.io/@haindpwn/antiword-word8-plcflst-count-and-fkp-run-oob-read ↗
- https://github.com/rsdoiel/antiword/blob/fe4b579067122a2d9d62647efb1ee7cfe3ca92bb/prop8.c#L997-L1022 ↗
- https://github.com/rsdoiel/antiword/blob/fe4b579067122a2d9d62647efb1ee7cfe3ca92bb/prop8.c#L1461-L1474 ↗
- https://www.vulncheck.com/advisories/antiword-through-0.37-stack-out-of-bounds-read-via-prop8-c-fkp-parsing ↗