CVE-2012-0037

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 13.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2012-06-17 · updated 2026-06-16
Weakness: CWE-611

Description

Redland Raptor (aka libraptor) before 2.0.7, as used by OpenOffice 3.3 and 3.4 Beta, LibreOffice before 3.4.6 and 3.5.x before 3.5.1, and other products, allows user-assisted remote attackers to read arbitrary files via a crafted XML external entity (XXE) declaration and reference in an RDF document.

Affected products

Apache Software Foundation Apache OpenOffice: 3.3.0, 3.4.0-beta
Debian Linux: 6.0
Fedoraproject Fedora: 16, 17
librdf Raptor: before 2.0.7 — fixed in 2.0.7
The Document Foundation LibreOffice: before 3.4.6; 3.5.0 — fixed in 3.4.6
RedHat Enterprise Linux Desktop: 5.0, 6.0
RedHat Enterprise Linux Eus: 6.2
RedHat Enterprise Linux Server: 5.0, 6.0
RedHat Enterprise Linux Server Aus: 6.2
RedHat Enterprise Linux Workstation: 5.0, 6.0
RedHat Gluster Storage Server For On-Premise: 2.0
RedHat Storage: 2.0
RedHat Storage For Public Cloud: 2.0

How to fix

Upgrade to a fixed version: librdf Raptor 2.0.7; The Document Foundation LibreOffice 3.4.6. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2012-0037 or the next vulnerability affects your stack