Veracode Vulnerability DatabaseVERACODE:23776Arbitrary Code Execution
9.3 High
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
openoffice.org is vulnerable to arbitrary code execution. An integer underflow flaw and a boundary error flaw, both possibly leading to a heap-based buffer overflow, were found in the way OpenOffice.org parses certain records in Microsoft Word documents. An attacker could create a specially-crafted Microsoft Word document, which once opened by an unsuspecting user, could cause OpenOffice.org to crash or, potentially, execute arbitrary code with the permissions of the user running OpenOffice.org.
References
development.openoffice.org/releases/3.1.1.html
lists.opensuse.org/opensuse-security-announce/2009-09/msg00001.html
secunia.com/advisories/35036
secunia.com/advisories/36750
secunia.com/advisories/60799
secunia.com/secunia_research/2009-26/
sunsolve.sun.com/search/document.do?assetkey=1-26-263508-1
sunsolve.sun.com/search/document.do?assetkey=1-77-1020715.1-1
www.debian.org/security/2009/dsa-1880
www.gentoo.org/security/en/glsa/glsa-201408-19.xml
www.mandriva.com/security/advisories?name=MDVSA-2010:035
www.mandriva.com/security/advisories?name=MDVSA-2010:091
www.mandriva.com/security/advisories?name=MDVSA-2010:105
www.openoffice.org/security/cves/CVE-2009-0200-0201.html
www.redhat.com/security/updates/classification/#important
www.securityfocus.com/archive/1/506194/100/0/threaded
www.securityfocus.com/bid/36200
www.vupen.com/english/advisories/2009/2490
access.redhat.com/errata/RHSA-2009:1426
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10881
Related
9.3 High
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C