CVE-2010-3450

CVE-2010-3450 is a vulnerability in OpenOffice.org 2.x/3.x up to 3.3 where a directory traversal flaw in handling of XSLT JAR filter descriptions and OpenOffice.org Extension (.oxt) files (and, in some listings, related JAR/ZIP entries) allows remote attackers to overwrite arbitrary files via a c...

CVE-2010-3451

CVE-2010-3451 is a use-after-free vulnerability in OpenOffice.org’s oowriter (OOo) 2.x and 3.x up to before 3.3. It allows remote attackers to crash the application or potentially execute arbitrary code via malformed tables in an RTF document. The issue arises from insecure parsing of RTF tables,...

CVE-2010-4643

OpenOffice.org/OpenOffice.org Impress (2.x–3.x) contains a heap-based buffer overflow in the TGA (Truevision TGA) image handling that can be triggered by a crafted TGA file embedded in ODF or Office documents, potentially causing crashes or arbitrary code execution. The CVE is referenced across m...

CVE-2010-3454

OpenOffice.org/OpenOffice.org2/3.x before 3.3 is affected by multiple off-by-one and out-of-bounds write flaws in WW8DopTypography::ReadFromMem (OOo), triggered by crafted Word .DOC typography data. This can cause denial of service or arbitrary code execution. Remediation: apply the patched/OpenO...

CVE-2010-3453

CVE-2010-3453 affects OpenOffice.org upstream: WW8ListManager in oowriter handles Word .DOC WW8 list data; root cause is an out-of-bounds/heap write due to an unspecified list levels count in user-defined styles. Affected products are OpenOffice.org 2.x and 3.x prior to 3.3. Consequences include ...

CVE-2010-3452

CVE-2010-3452 is a use-after-free in OpenOffice.org’s oowriter that can crash the application or, potentially, allow arbitrary code execution via crafted RTF tags. Affected: OpenOffice.org 2.x/3.x before 3.3. Remediation: apply vendor security updates; advisories from multiple vendors (openSUSE/S...

CVE-2010-4253

CVE-2010-4253 is confirmed in OpenOffice/OpenOffice Impress. The vulnerability is a heap-based buffer overflow in Impress of OpenOffice.org 2.x and 3.x (before 3.3) triggered by a crafted PNG inside an ODF or Microsoft Office document (e.g., PowerPoint), leading to a remote crash or possible arbi...

CVE-2010-3689

CVE-2010-3689 affects OpenOffice.org (OpenOffice.org/OpenOffice) within the 3.x line prior to 3.3. The issue arises when soffice sets LD_LIBRARY_PATH with a zero-length directory name, enabling a local attacker to place a Trojan horse shared library in the current working directory and elevate pr...