LibreOffice, OpenOffice Security Vulnerabilities

CVE-2007-0238

Stack-based buffer overflow in filter\starcalc\scflt.cxx in the StarCalc parser in OpenOffice.org (OOo) Office Suite before 2.2, and 1.x before 1.1.5 Patch, allows user-assisted remote attackers to execute arbitrary code via a document with a long...

CVE-2007-0238

Stack-based buffer overflow in filter\starcalc\scflt.cxx in the StarCalc parser in OpenOffice.org (OOo) Office Suite before 2.2, and 1.x before 1.1.5 Patch, allows user-assisted remote attackers to execute arbitrary code via a document with a long...

CVE-2007-0239

OpenOffice.org (OOo) Office Suite allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in a prepared link in a crafted...

CVE-2007-0238

Stack-based buffer overflow in filter\starcalc\scflt.cxx in the StarCalc parser in OpenOffice.org (OOo) Office Suite before 2.2, and 1.x before 1.1.5 Patch, allows user-assisted remote attackers to execute arbitrary code via a document with a long...

Mandrake Linux Security Advisory : libwpd (MDKSA-2007:063)

iDefense reported several overflow bugs in libwpd. An attacker could create a carefully crafted Word Perfect file that could cause an application linked with libwpd, such as OpenOffice, to crash or possibly execute arbitrary code if the file was opened by a victim. Updated packages have been...

Mandrake Linux Security Advisory : openoffice.org (MDKSA-2007:064)

iDefense reported several overflow bugs in libwpd. An attacker could create a carefully crafted Word Perfect file that could cause an application linked with libwpd, such as OpenOffice, to crash or possibly execute arbitrary code if the file was opened by a victim. OpenOffice.org-2.X contains an...

libwpd /OpenOffice / AbiWord multiple security vulnerabilities

Multiple buffer overflows on Word Perfect documents...

(RHSA-2007:0055) Important: libwpd security update

libwpd is a library for reading and converting Word Perfect documents. iDefense reported several overflow bugs in libwpd. An attacker could create a carefully crafted Word Perfect file that could cause an application linked with libwpd, such as OpenOffice, to crash or possibly execute arbitrary...

Critical: thunderbird security update

[1.5.0.10-0.1.el4.0.1] - defaults changed to oracle. [1.5.0.10-0.1.el4] - Update to 1.5.0.10 [1.5.0.9-0.2.el4] - Fix langpack support to start in the user's locale where possible - Allow OpenOffice to send files as Thunderbird...

SUSE-SA:2007:001: OpenOffice_org

The remote host is missing the patch for the advisory SUSE-SA:2007:001 (OpenOffice_org). Security problems were fixed in the WMF and Enhanced WMF handling in OpenOffice_org These could potentially be used to execute code or crash OpenOffice when a user could be convinced to open specially crafted.....

GLSA-200701-07 : OpenOffice.org: EMF/WMF file handling vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200701-07 (OpenOffice.org: EMF/WMF file handling vulnerabilities) John Heasman of NGSSoftware has discovered integer overflows in the EMR_POLYPOLYGON and EMR_POLYPOLYGON16 processing and an error within the handling of...

Fedora Core 5 : openoffice.org-2.0.2-5.20.2 / Fedora Core 6 : openoffice.org-2.0.4-5.5.10 (2007-005)

Rectifies an error patch condition where by corrupt wmf/emf files with out of bounds values in the emf/wmf file could enable an attacker by constructing a malicious file to execute arbitrary code if opened in OpenOffice by a victim. Note that Tenable Network Security has extracted the preceding...

OpenOffice WMF/EMF文件处理堆溢出漏洞

OpenOffice是个整合性的软件，包含了许多文字处理、表格、公式等办公工具。 OpenOffice在处理META_ESCAPE记录时存在截尾错误。在svtools\source\filter.vcl\wmf\winwmf.cxx文件中： case W_META_ESCAPE : ... sal_uInt32 i, nStringLen, nDXCount; ... aMemoryStream >> aPt.X() >> aPt.Y() >> nStringLen; sal_Unicode* pBuf = aString.AllocBuffer(...

OpenOffice.org: EMF/WMF file handling vulnerabilities

Background OpenOffice.org is an open source office productivity suite, including word processing, spreadsheet, presentation, drawing, data charting, formula editing, and file conversion facilities. Description John Heasman of NGSSoftware has discovered integer overflows in the EMR_POLYPOLYGON and.....

OpenOffice WMF/EMF整数溢出漏洞

OpenOffice是一款开放源代码的文字处理程序。 OpenOffice处理WMF/EMF文件存在整数溢出，远程攻击者可以利用漏洞以应用程序进程权限执行任意指令。 构建恶意的WMF/EMF文件，诱使用户访问，可导致OpenOffice发生整数溢出错误而崩溃。目前没有详细漏洞细节提供。 OpenOffice 1.0.x OpenOffice 1.1.x OpenOffice.org 2.x 升级到OpenOffice 2.1版本：...

OpenOffice fails to properly process WMF and EMF files

Overview Multiple buffer overflow vulnerabilities exist in the OpenOffice.org office suite. If successfully exploited, these vulnerabilities may allow an attacker to execute arbitrary code on a vulnerable system. Description OpenOffice.org is a free office suite that is available for multiple...

code execution in OpenOffice_org

Security problems were fixed in the WMF and Enhanced WMF handling in OpenOffice_org These could potentially be used to execute code or crash OpenOffice when a user could be convinced to open specially crafted document (for instance a document sent by E-mail). Solution There is no known workaround,....

CVE-2006-5870

Multiple integer overflows in OpenOffice.org (OOo) 2.0.4 and earlier, and possibly other versions before 2.1.0; and StarOffice 6 through 8; allow user-assisted remote attackers to execute arbitrary code via a crafted (a) WMF or (b) EMF file that triggers heap-based buffer overflows in (1)...

OpenOffice buffer overflow

Integer overflow leads to heap buffer overflow on EMF/WMF files...

[VulnWatch] High Risk Vulnerability in the OpenOffice and StarOffice Suites

John Heasman of NGSSoftware has discovered several high risk vulnerabilities in the handling of WMF and EMF graphics formats within the OpenOffice StarOffice suite. The vulnerabilities, three heap overflows, affect OpenOffice 2.1.0 and StarOffice 6, 7 and 8. If an attacker can coax a user into...

OpenOffice畸形Word文件整数溢出漏洞

OpenOffice是个整合性的软件，包含了许多文字处理、表格、公式等办公工具。 OpenOffice在处理某些畸形Word文档时存在整数溢出，远程攻击者可能利用此漏洞在用户机器上执行任意指令。 memset会试图向堆中写入大量的0： Breakpoint 2, WW8PLCF::GeneratePLCF (this=0xb12a36e8, pSt=0xabae6cc8, nPN=0, ncpN=587202560) at /usr/src/debug/OOD680_m5/sw/source/filter/ww8/ww8scan.cxx:2299 2299 nIMax...

CVE-2006-6628

Integer overflow in OpenOffice.org (OOo) 2.1 allows user-assisted remote attackers to cause a denial of service (application crash) via a crafted DOC file, as demonstrated by the 12122006-djtest.doc file, a variant of CVE-2006-6561 in a separate...

Microsoft Word / Open Office 0-day security vulnerability

2 different unknown vulnerabilities are used for hidden malware...

adv51-K-159-2006.txt

...

[ECHO_ADV_51$2006] docmint <= 2.0 (MY_ENV[BASE_ENGINE_LOC]) Remote File Inclusion Vulnerability

ECHO_ADV_51$2006 [ECHO_ADV_51$2006] docmint <= 2.0 (MY_ENV[BASE_ENGINE_LOC]) Remote File Inclusion Vulnerability Author : M.Hasran Addahroni Date : Oct, 9th 2006 Location : Australia, Sydney Web : http://advisories.echo.or.id/adv/adv51-K-159-2006.txt Critical...

GLSA-200607-12 : OpenOffice.org: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200607-12 (OpenOffice.org: Multiple vulnerabilities) Internal security audits by OpenOffice.org have discovered three security vulnerabilities related to Java applets, macros and the XML file format parser. Specially...

OpenOffice.org: Multiple vulnerabilities

Background OpenOffice.org is an open source office productivity suite, including word processing, spreadsheet, presentation, drawing, data charting, formula editing, and file conversion facilities. Description Internal security audits by OpenOffice.org have discovered three security...

OpenOffice.org may fail to properly contain certain Java applets

Overview The OpenOffice.org team has reported a vulnerability in how the 1.1 and 2.0 versions of OpenOffice.org handle certain Java applets. Description OpenOffice.org is an office suite that is available for multiple operating systems, including Windows, Linux, Apple Mac OS X, and BSD. It...

OpenOffice.org vulnerabilities

Releases Ubuntu 5.10 Details USN-313-1 fixed several vulnerabilities in OpenOffice for Ubuntu 5.04 and Ubuntu 6.06 LTS. This followup advisory provides the corresponding update for Ubuntu 5.10. For reference, these are the details of the original USN: It was possible to embed Basic macros in...

Mandrake Linux Security Advisory : OpenOffice.org (MDKSA-2006:118)

OpenOffice.org 1.1.x up to 1.1.5 and 2.0.x before 2.0.3 allows user-complicit attackers to conduct unauthorized activities via an OpenOffice document with a malicious BASIC macro, which is executed without prompting the user. (CVE-2006-2198) An unspecified vulnerability in Java Applets in...

CVE-2006-2198

OpenOffice.org (aka StarOffice) 1.1.x up to 1.1.5 and 2.0.x before 2.0.3 allows user-assisted attackers to conduct unauthorized activities via an OpenOffice document with a malicious BASIC macro, which is executed without prompting the...

CVE-2006-2199

Unspecified vulnerability in Java Applets in OpenOffice.org 1.1.x (aka StarOffice) up to 1.1.5 and 2.0.x before 2.0.3 allows user-assisted attackers to escape the Java sandbox and conduct unauthorized activities via certain applets in OpenOffice...

Security feature bypass

Unspecified vulnerability in Java Applets in OpenOffice.org 1.1.x (aka StarOffice) up to 1.1.5 and 2.0.x before 2.0.3 allows user-assisted attackers to escape the Java sandbox and conduct unauthorized activities via certain applets in OpenOffice...

CVE-2006-3117

Heap-based buffer overflow in OpenOffice.org (aka StarOffice) 1.1.x up to 1.1.5 and 2.0.x before 2.0.3 allows user-assisted attackers to execute arbitrary code via a crafted OpenOffice XML document that is not properly handled by (1) Calc, (2) Draw, (3) Impress, (4) Math, or (5) Writer, aka "File.....

CVE-2006-3117

Heap-based buffer overflow in OpenOffice.org (aka StarOffice) 1.1.x up to 1.1.5 and 2.0.x before 2.0.3 allows user-assisted attackers to execute arbitrary code via a crafted OpenOffice XML document that is not properly handled by (1) Calc, (2) Draw, (3) Impress, (4) Math, or (5) Writer, aka "File.....

CVE-2006-2199

Unspecified vulnerability in Java Applets in OpenOffice.org 1.1.x (aka StarOffice) up to 1.1.5 and 2.0.x before 2.0.3 allows user-assisted attackers to escape the Java sandbox and conduct unauthorized activities via certain applets in OpenOffice...

CVE-2006-2198

OpenOffice.org (aka StarOffice) 1.1.x up to 1.1.5 and 2.0.x before 2.0.3 allows user-assisted attackers to conduct unauthorized activities via an OpenOffice document with a malicious BASIC macro, which is executed without prompting the...

Code injection

OpenOffice.org (aka StarOffice) 1.1.x up to 1.1.5 and 2.0.x before 2.0.3 allows user-assisted attackers to conduct unauthorized activities via an OpenOffice document with a malicious BASIC macro, which is executed without prompting the...

CVE-2006-3117

Heap-based buffer overflow in OpenOffice.org (aka StarOffice) 1.1.x up to 1.1.5 and 2.0.x before 2.0.3 allows user-assisted attackers to execute arbitrary code via a crafted OpenOffice XML document that is not properly handled by (1) Calc, (2) Draw, (3) Impress, (4) Math, or (5) Writer, aka "File.....

CVE-2006-2199

Unspecified vulnerability in Java Applets in OpenOffice.org 1.1.x (aka StarOffice) up to 1.1.5 and 2.0.x before 2.0.3 allows user-assisted attackers to escape the Java sandbox and conduct unauthorized activities via certain applets in OpenOffice...

CVE-2006-2198

OpenOffice.org (aka StarOffice) 1.1.x up to 1.1.5 and 2.0.x before 2.0.3 allows user-assisted attackers to conduct unauthorized activities via an OpenOffice document with a malicious BASIC macro, which is executed without prompting the...

Multiple OpenOffice security vulnerabilities

BASIC macro auto launch without user intercation, Java applet sandbox protection bypass, XML parsing buffer...

CVE-2006-2198

OpenOffice.org (aka StarOffice) 1.1.x up to 1.1.5 and 2.0.x before 2.0.3 allows user-assisted attackers to conduct unauthorized activities via an OpenOffice document with a malicious BASIC macro, which is executed without prompting the...

CVE-2006-2199

Unspecified vulnerability in Java Applets in OpenOffice.org 1.1.x (aka StarOffice) up to 1.1.5 and 2.0.x before 2.0.3 allows user-assisted attackers to escape the Java sandbox and conduct unauthorized activities via certain applets in OpenOffice...

OpenOffice < 2.0.3 Multiple Vulnerabilities

The remote host is running a version of OpenOffice.org which is older than version 2.0.3. An attacker may use this to execute arbitrary code on this host. To succeed, the attacker would have to send a rogue file to a user of the remote computer and have him open it. The file could be crafted in...

CVE-2006-3117

Heap-based buffer overflow in OpenOffice.org (aka StarOffice) 1.1.x up to 1.1.5 and 2.0.x before 2.0.3 allows user-assisted attackers to execute arbitrary code via a crafted OpenOffice XML document that is not properly handled by (1) Calc, (2) Draw, (3) Impress, (4) Math, or (5) Writer, aka "File.....

GLSA-200603-25 : OpenOffice.org: Heap overflow in included libcurl

The remote host is affected by the vulnerability described in GLSA-200603-25 (OpenOffice.org: Heap overflow in included libcurl) OpenOffice.org includes libcurl code. This libcurl code is vulnerable to a heap overflow when it tries to parse a URL that exceeds a 256-byte limit (GLSA...

cURL command line download utility buffer overflow

Buffer overflow on parsing tftp://...

[ GLSA 200603-25 ] OpenOffice.org: Heap overflow in included libcurl

Gentoo Linux Security Advisory GLSA 200603-25 http://security.gentoo.org/ Severity: Normal Title: OpenOffice.org: Heap overflow in included libcurl Date: March 27, 2006 Bugs: #126433 ID: 200603-25 ...

Microsoft Office Products - Array Index Bounds Error (PoC)

...