CVE-2012-0037

Redland Raptor (aka libraptor) before 2.0.7, as used by OpenOffice 3.3 and 3.4 Beta, LibreOffice before 3.4.6 and 3.5.x before 3.5.1, and other products, allows user-assisted remote attackers to read arbitrary files via a crafted XML external entity (XXE) declaration and reference in an RDF document.

• CWE-611

• http://blog.documentfoundation.org/2012/03/22/tdf-announces-libreoffice-3-4-6/Release Notes
• http://librdf.org/raptor/RELEASE.html#rel2_0_7Release Notes
• http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077708.htmlMailing List
• http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078242.htmlMailing List
• http://rhn.redhat.com/errata/RHSA-2012-0410.htmlThird Party Advisory
• http://rhn.redhat.com/errata/RHSA-2012-0411.htmlThird Party Advisory
• http://secunia.com/advisories/48479Broken Link, Vendor Advisory
• http://secunia.com/advisories/48493Broken Link, Vendor Advisory
• http://secunia.com/advisories/48494Broken Link
• http://secunia.com/advisories/48526Broken Link, Vendor Advisory
• http://secunia.com/advisories/48529Broken Link, Vendor Advisory
• http://secunia.com/advisories/48542Broken Link, Vendor Advisory
• http://secunia.com/advisories/48649Broken Link
• http://secunia.com/advisories/50692Broken Link
• http://secunia.com/advisories/60799Broken Link
• http://security.gentoo.org/glsa/glsa-201209-05.xmlThird Party Advisory
• http://vsecurity.com/resources/advisory/20120324-1/Broken Link
• http://www.debian.org/security/2012/dsa-2438Third Party Advisory
• http://www.gentoo.org/security/en/glsa/glsa-201408-19.xmlThird Party Advisory
• http://www.libreoffice.org/advisories/CVE-2012-0037/Vendor Advisory
• http://www.mandriva.com/security/advisories?name=MDVSA-2012:061Broken Link
• http://www.mandriva.com/security/advisories?name=MDVSA-2012:062Broken Link
• http://www.mandriva.com/security/advisories?name=MDVSA-2012:063Broken Link
• http://www.openoffice.org/security/cves/CVE-2012-0037.htmlMitigation, Patch
• http://www.openwall.com/lists/oss-security/2012/03/27/4Exploit, Mailing List
• http://www.osvdb.org/80307Broken Link
• http://www.securityfocus.com/bid/52681Broken Link, Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id?1026837Broken Link, Third Party Advisory, VDB Entry
• https://exchange.xforce.ibmcloud.com/vulnerabilities/74235Third Party Advisory, VDB Entry
• https://github.com/dajobe/raptor/commit/a676f235309a59d4aa78eeffd2574ae5d341fcb0Patch
• https://lists.apache.org/thread.html/re0504f08000df786e51795940501e81a5d0ae981ecca68141e87ece0%40%3Ccommits.openoffice.apache.org%3EMailing List, Patch
• http://blog.documentfoundation.org/2012/03/22/tdf-announces-libreoffice-3-4-6/Release Notes
• http://librdf.org/raptor/RELEASE.html#rel2_0_7Release Notes
• http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077708.htmlMailing List
• http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078242.htmlMailing List
• http://rhn.redhat.com/errata/RHSA-2012-0410.htmlThird Party Advisory
• http://rhn.redhat.com/errata/RHSA-2012-0411.htmlThird Party Advisory
• http://secunia.com/advisories/48479Broken Link, Vendor Advisory
• http://secunia.com/advisories/48493Broken Link, Vendor Advisory
• http://secunia.com/advisories/48494Broken Link
• http://secunia.com/advisories/48526Broken Link, Vendor Advisory
• http://secunia.com/advisories/48529Broken Link, Vendor Advisory
• http://secunia.com/advisories/48542Broken Link, Vendor Advisory
• http://secunia.com/advisories/48649Broken Link
• http://secunia.com/advisories/50692Broken Link
• http://secunia.com/advisories/60799Broken Link
• http://security.gentoo.org/glsa/glsa-201209-05.xmlThird Party Advisory
• http://vsecurity.com/resources/advisory/20120324-1/Broken Link
• http://www.debian.org/security/2012/dsa-2438Third Party Advisory
• http://www.gentoo.org/security/en/glsa/glsa-201408-19.xmlThird Party Advisory
• http://www.libreoffice.org/advisories/CVE-2012-0037/Vendor Advisory
• http://www.mandriva.com/security/advisories?name=MDVSA-2012:061Broken Link
• http://www.mandriva.com/security/advisories?name=MDVSA-2012:062Broken Link
• http://www.mandriva.com/security/advisories?name=MDVSA-2012:063Broken Link
• http://www.openoffice.org/security/cves/CVE-2012-0037.htmlMitigation, Patch
• http://www.openwall.com/lists/oss-security/2012/03/27/4Exploit, Mailing List
• http://www.osvdb.org/80307Broken Link
• http://www.securityfocus.com/bid/52681Broken Link, Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id?1026837Broken Link, Third Party Advisory, VDB Entry
• https://exchange.xforce.ibmcloud.com/vulnerabilities/74235Third Party Advisory, VDB Entry
• https://github.com/dajobe/raptor/commit/a676f235309a59d4aa78eeffd2574ae5d341fcb0Patch
• https://lists.apache.org/thread.html/re0504f08000df786e51795940501e81a5d0ae981ecca68141e87ece0%40%3Ccommits.openoffice.apache.org%3EMailing List, Patch

Published

Jun 17, 2012

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2012-0031scoreboard.c in the Apache HTTP Server 2.2.21 and earlier mi…
• CVE-2012-0032Red Hat JBoss Operations Network (JON) before 3.0.1 uses 077…
• CVE-2012-0033The CBounceDCCMod::OnPrivCTCP function in bouncedcc.cpp in t…
• CVE-2012-0034The NonManagedConnectionFactory in JBoss Enterprise Applicat…
• CVE-2012-0035Untrusted search path vulnerability in EDE in CEDET before 1…
• CVE-2012-0036curl and libcurl 7.2x before 7.24.0 do not properly consider…
• CVE-2012-0038Integer overflow in the xfs_acl_from_disk function in fs/xfs…5.5
• CVE-2012-0039GLib 2.31.8 and earlier, when the g_str_hash function is use…7.5
• CVE-2012-0040Cross-site scripting (XSS) vulnerability in modules/core/www…
• CVE-2012-0041The dissect_packet function in epan/packet.c in Wireshark 1.…
• CVE-2012-0042Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 does no…
• CVE-2012-0043Buffer overflow in the reassemble_message function in epan/d…