CVE-2020-25713: 
LibreOffice vulnerability analysis and mitigation

A vulnerability (CVE-2020-25713) was discovered in the Raptor RDF Syntax Library (raptor2) where a malformed input file can lead to a segmentation fault due to an out-of-bounds array access in the raptor_xml_writer_start_element_common function. The vulnerability was reported in 2020 and affects version 2.0.15 and earlier of the library (Librdf Bug, NVD).

The vulnerability is classified as an out-of-bounds read (CWE-125) and improper input validation (CWE-20) issue. It received a CVSS v3.1 base score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. The bug occurs in the raptor_xml_writer_start_element_common function where an incorrect array index comparison leads to accessing memory outside the allocated buffer (Librdf Bug).

When exploited, this vulnerability results in a segmentation fault, potentially causing a denial of service condition. The impact is limited to availability, with no direct effects on confidentiality or integrity of the system (NVD).

The vulnerability can be triggered by providing a specially crafted malformed input file to applications using the Raptor library. The attack requires network access and low privilege level, but no user interaction (NVD).

The vulnerability was fixed in raptor2 version 2.0.16. Various Linux distributions have released security updates to address this issue, including Fedora 32 and 33 (version 2.0.15-27), Debian 9 stretch (version 2.0.14-1+deb9u2), and Red Hat Enterprise Linux 8 (Debian Advisory, Fedora Update).