Multiple OpenOffice security vulnerabilities

BASIC macro auto launch without user intercation, Java applet sandbox protection bypass, XML parsing buffer overflow...

CVE-2002-2210

The installation of OpenOffice 1.0.1 allows local users to overwrite files and possibly gain privileges via a symlink attack on the USERNAMEautoresponse.conf temporary file...

CVE-2002-2210

The CVE-2002-2210 entry concerns OpenOffice 1.0.1, where local users can overwrite files and possibly gain privileges via a symlink attack on the USERNAME_autoresponse.conf temporary file. The root cause is a symlink handling issue that allows a nearby user to redirect writes to a privileged or s...

MS Office Products Array Index Bounds Error (unpatched) PoC

No description provided by source. Full archive at http://www.milw0rm.com/sploits/excel03262006.rar Topic : Microsoft Office 2002 - Excel/Powerpoint/Word.. 10.0.2614.0 = 11.0.5612.0 Date : 02/12/2006 Author : posidron [email protected] Table of Contens ================ - Some Excel Information...

[Full-disclosure] [HV-HIGH] Microsoft Excel Named Range Arbitrary Code Execution

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Microsoft Excel Named Range Arbitrary Code Execution Classification: =============== Level: low-med-HIGH-crit ID: HEXVIEW200603141 URL: http://www.hexview.com/docs/20060314-1.txt References: =============== Originally published by fearwall on eBay CVE...

Ubuntu 4.10 / 5.04 : openoffice.org vulnerability (USN-121-1)

The StgCompObjStream::Load failed to check the validity of a length field in documents. If an attacker tricked a user to open a specially crafted OpenOffice file, this triggered a buffer overflow which could lead to arbitrary code execution with the privileges of the user opening the document. Th...

CVE-2005-4636

OpenOffice.org 2.0 and earlier, when hyperlinks has been disabled, does not prevent the user from clicking the WWW-browser button in the Hyperlink dialog, which makes it easier for attackers to trick the user into bypassing intended security settings...

FreeBSD : openoffice -- DOC document heap overflow vulnerability (b206dd82-ac67-11d9-a788-0001020eed82)

AD-LAB reports that a heap-based buffer overflow vulnerability exists in OpenOffice's handling of DOC documents. When reading a DOC document 16 bit from a 32 bit integer is used for memory allocation, but the full 32 bit is used for further processing of the document. This can allow an attacker t...

USN-121-1: OpenOffice.org vulnerability

The StgCompObjStream::Load failed to check the validity of a length field in documents. If an attacker tricked a user to open a specially crafted OpenOffice file, this triggered a buffer overflow which could lead to arbitrary code execution with the privileges of the user opening the document. Th...

CVE-2005-0941

The StgCompObjStream::Load function in OpenOffice.org OpenOffice 1.1.4 and earlier allocates memory based on 16 bit length values, but process memory using 32 bit values, which allows remote attackers to cause a denial of service and possibly execute arbitrary code via a DOC document with certain...

CVE-2005-0941

The StgCompObjStream::Load function in OpenOffice.org OpenOffice 1.1.4 and earlier allocates memory based on 16 bit length values, but process memory using 32 bit values, which allows remote attackers to cause a denial of service and possibly execute arbitrary code via a DOC document with certain...

security flaw

The StgCompObjStream::Load function in OpenOffice.org OpenOffice 1.1.4 and earlier allocates memory based on 16 bit length values, but process memory using 32 bit values, which allows remote attackers to cause a denial of service and possibly execute arbitrary code via a DOC document with certain...

CVE-2005-0941

OpenOffice.org (1.1.4 and earlier) is affected by CVE-2005-0941 due to a mismatch between 16-bit length values used for memory allocation and 32-bit processing in StgCompObjStream::Load, causing a heap-based buffer overflow via crafted DOC files. This can lead to remote denial of service and pote...

[Full-disclosure] OpenOffice DOC document Heap Overflow

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 OpenOffice DOC document Heap Overflow Security Advisory Advisory:ADLAB-05001 OpenOffice DOC document Heap Overflow Class: Design Error DATE:30/3/2005 CVEID:CAN-2005-0941 Vulnerable: =OpenOffice OpenOffice 1.1.4 -OpenOffice OpenOffice 2.0dev...

openoffice -- DOC document heap overflow vulnerability

AD-LAB reports that a heap-based buffer overflow vulnerability exists in OpenOffice's handling of DOC documents. When reading a DOC document 16 bit from a 32 bit integer is used for memory allocation, but the full 32 bit is used for further processing of the document. This can allow an attacker t...

OpenOffice buffer overflow

Buffer overflow on Microsoft Word files parsing...

GLSA-200410-17 : OpenOffice.org: Temporary files disclosure

The remote host is affected by the vulnerability described in GLSA-200410-17 OpenOffice.org: Temporary files disclosure On start-up, OpenOffice.org 1.1.2 creates a temporary directory with insecure permissions. When a document is saved, a compressed copy of it can be found in that directory. Impa...

CVE-2004-0752

OpenOffice OOo 1.1.2 creates predictable directory names with insecure permissions during startup, which may allow local users to read or list files of other users...

CVE-2004-0752

OpenOffice OOo 1.1.2 creates predictable directory names with insecure permissions during startup, which may allow local users to read or list files of other users...

OpenOffice.org: Temporary files disclosure

Background OpenOffice.org is an office productivity suite, including word processing, spreadsheets, presentations, drawings, data charting, formula editing, and file conversion facilities. Description On start-up, OpenOffice.org 1.1.2 creates a temporary directory with insecure permissions. When ...