ONLYOFFICE Document Server 缓冲区错误漏洞

漏洞信息详情

Ascensio System ONLYOFFICE Document Server是拉脱维亚Ascensio System公司的一套在线办公协作套件。该产品支持文本、电子表格和演示文稿的查看和编辑等。

ONLYOFFICE Document Server v4.0.0-9-v6.0.0 存在缓冲区错误漏洞，该漏洞源于[core]模块存在BMP图像处理内部堆缓冲区溢出漏洞。攻击者可利用该漏洞可以获得DocumentServer上的远程代码执行。

目前厂商已发布升级补丁以修复漏洞，补丁获取链接：

https://github.com/ONLYOFFICE/DocumentServer

来源:MISC

链接:https://github.com/ONLYOFFICE/core

来源:MISC

链接:https://github.com/ONLYOFFICE/core/blob/v6.0.1.15/DesktopEditor/cximage/CxImage/ximabmp.cpp#L358

来源:MISC

链接:https://github.com/ONLYOFFICE/core/blob/v6.0.1.15/DesktopEditor/cximage/CxImage/ximabmp.cpp#L354

来源:MISC

链接:https://github.com/ONLYOFFICE/core/blob/v6.0.1.15/ASCOfficePPTXFile/Editor/BinaryFileReaderWriter.cpp#L424

来源:MISC

链接:https://github.com/ONLYOFFICE/DocumentServer

来源:MISC

链接:https://github.com/ONLYOFFICE/core/blob/v6.0.1.15/ASCOfficePPTXFile/Editor/BinaryFileReaderWriter.cpp#L428

来源:MISC

链接:https://github.com/merrychap/poc_exploits/tree/master/ONLYOFFICE/CVE-2021-25832

暂无