7 matches found
CVE-2026-91752
GNU libextractor before 1.15 contains a stack-based buffer overflow vulnerability in the processstaroffice function that sizes a variable-length stack array from attacker-controlled OLE2 stream data. Attackers can craft malicious StarOffice documents that allocate up to 4 MB on the stack, causing...
CVE-2026-91752 GNU libextractor before 1.15 Stack Overflow via OLE2
GNU libextractor before 1.15 contains a stack-based buffer overflow vulnerability in the processstaroffice function that sizes a variable-length stack array from attacker-controlled OLE2 stream data. Attackers can craft malicious StarOffice documents that allocate up to 4 MB on the stack, causing...
CVE-2026-91752
GNU libextractor before 1.15 contains a stack-based buffer overflow in the process_star_office function, where a variable-length stack array is sized from attacker-controlled OLE2 stream data. A crafted StarOffice document can force up to 4 MB of stack allocation, triggering a stack overflow that...
EUVD-2026-78234
GNU libextractor before 1.15 contains a stack-based buffer overflow vulnerability in the processstaroffice function that sizes a variable-length stack array from attacker-controlled OLE2 stream data. Attackers can craft malicious StarOffice documents that allocate up to 4 MB on the stack, causing...
SUSE CVE-2008-2238
Multiple integer overflows in OpenOffice.org OOo 2.x before 2.4.2 allow remote attackers to execute arbitrary code via crafted EMR records in an EMF file associated with a StarOffice/StarSuite document, which trigger a heap-based buffer overflow...
OpenOffice.org multiple EMF buffer overflows
Multiple integer overflows in OpenOffice.org OOo 2.x before 2.4.2 allow remote attackers to execute arbitrary code via crafted EMR records in an EMF file associated with a StarOffice/StarSuite document, which trigger a heap-based buffer overflow...
OpenOffice.org WMF integer overflow
Heap-based buffer overflow in OpenOffice.org OOo 2.x before 2.4.2 allows remote attackers to execute arbitrary code via a crafted WMF file associated with a StarOffice/StarSuite document...