CVE-2007-4575: Code Injection
First published: Fri Sep 21 2007(Updated: )
HSQLDB before 1.8.0.9, as used in OpenOffice.org (OOo) 2 before 2.3.1, allows user-assisted remote attackers to execute arbitrary Java code via crafted database documents, related to "exposing static java methods."
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Openoffice Openoffice | =2.1 | |
| Openoffice Openoffice | =2.2 | |
| Openoffice Openoffice | =2.0.3_1 | |
| Openoffice Openoffice | =2.2.1 | |
| Openoffice Openoffice | =2.0.4 | |
| Openoffice Openoffice | <=2.3 | |
| Openoffice Openoffice | =2.0.3 | |
| Openoffice Openoffice | =2.0beta | |
| Openoffice Openoffice | =2.0.1 | |
| Openoffice Openoffice | =2.0.2 | |
| redhat/hibernate3 | <1:3.2.4-1.SP1_CP02.0jpp.ep1.1.el4 | 1:3.2.4-1.SP1_CP02.0jpp.ep1.1.el4 |
| redhat/hibernate3-annotations | <0:3.2.1-1.patch02.1jpp.ep1.2.el4 | 0:3.2.1-1.patch02.1jpp.ep1.2.el4 |
| redhat/hibernate3-entitymanager | <0:3.2.1-1jpp.ep1.6.el4 | 0:3.2.1-1jpp.ep1.6.el4 |
| redhat/jboss-aop | <0:1.5.5-1.CP01.0jpp.ep1.1.el4 | 0:1.5.5-1.CP01.0jpp.ep1.1.el4 |
| redhat/jbossas | <0:4.2.0-3.GA_CP02.ep1.3.el4 | 0:4.2.0-3.GA_CP02.ep1.3.el4 |
| redhat/jboss-cache | <0:1.4.1-4.SP8_CP01.1jpp.ep1.1.el4 | 0:1.4.1-4.SP8_CP01.1jpp.ep1.1.el4 |
| redhat/jboss-seam | <0:1.2.1-1.ep1.3.el4 | 0:1.2.1-1.ep1.3.el4 |
| redhat/jbossws-jboss42 | <0:1.2.1-0jpp.ep1.2.el4 | 0:1.2.1-0jpp.ep1.2.el4 |
| redhat/jcommon | <0:1.0.12-1jpp.ep1.2.el4 | 0:1.0.12-1jpp.ep1.2.el4 |
| redhat/jfreechart | <0:1.0.9-1jpp.ep1.2.el4 | 0:1.0.9-1jpp.ep1.2.el4 |
| redhat/rh-eap-docs | <0:4.2.0-3.GA_CP02.ep1.1.el4 | 0:4.2.0-3.GA_CP02.ep1.1.el4 |
| redhat/hibernate3 | <0:3.2.4-1.SP1_CP02.0jpp.ep1.1.el5.1 | 0:3.2.4-1.SP1_CP02.0jpp.ep1.1.el5.1 |
| redhat/hibernate3-annotations | <0:3.2.1-1.patch02.1jpp.ep1.2.el5.1 | 0:3.2.1-1.patch02.1jpp.ep1.2.el5.1 |
| redhat/jacorb | <0:2.3.0-1jpp.ep1.5.el5 | 0:2.3.0-1jpp.ep1.5.el5 |
| redhat/jboss-aop | <0:1.5.5-1.CP01.0jpp.ep1.1.el5 | 0:1.5.5-1.CP01.0jpp.ep1.1.el5 |
| redhat/jbossas | <0:4.2.0-4.GA_CP02.ep1.3.el5.3 | 0:4.2.0-4.GA_CP02.ep1.3.el5.3 |
| redhat/jboss-cache | <0:1.4.1-4.SP8_CP01.1jpp.ep1.1.el5 | 0:1.4.1-4.SP8_CP01.1jpp.ep1.1.el5 |
| redhat/jboss-remoting | <0:2.2.2-3.SP4.0jpp.ep1.1.el5 | 0:2.2.2-3.SP4.0jpp.ep1.1.el5 |
| redhat/jboss-seam | <0:1.2.1-1.ep1.3.el5 | 0:1.2.1-1.ep1.3.el5 |
| redhat/jbossweb | <0:2.0.0-3.CP05.0jpp.ep1.1.el5 | 0:2.0.0-3.CP05.0jpp.ep1.1.el5 |
| redhat/jcommon | <0:1.0.12-1jpp.ep1.2.el5 | 0:1.0.12-1jpp.ep1.2.el5 |
| redhat/jfreechart | <0:1.0.9-1jpp.ep1.2.el5.1 | 0:1.0.9-1jpp.ep1.2.el5.1 |
| redhat/rh-eap-docs | <0:4.2.0-3.GA_CP02.ep1.1.el5.1 | 0:4.2.0-3.GA_CP02.ep1.1.el5.1 |
| redhat/concurrent | <0:1.3.4-7jpp.ep1.6.el4 | 0:1.3.4-7jpp.ep1.6.el4 |
| redhat/glassfish-jaf | <0:1.1.0-0jpp.ep1.10.el4 | 0:1.1.0-0jpp.ep1.10.el4 |
| redhat/jbossxb | <0:1.0.0-2.SP1.0jpp.ep1.2.el4 | 0:1.0.0-2.SP1.0jpp.ep1.2.el4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.openoffice.org/security/cves/CVE-2007-4575.html
- http://www.securityfocus.com/bid/26703
- http://secunia.com/advisories/27928
- http://www.debian.org/security/2007/dsa-1419
- http://www.redhat.com/support/errata/RHSA-2007-1048.html
- http://www.redhat.com/support/errata/RHSA-2007-1090.html
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-103141-1
- http://www.securitytracker.com/id?1019041
- http://secunia.com/advisories/27914
- http://secunia.com/advisories/27916
- http://secunia.com/advisories/27931
- http://secunia.com/advisories/28018
- http://bugs.gentoo.org/show_bug.cgi?id=200771
- http://bugs.gentoo.org/show_bug.cgi?id=201799
- http://www.gentoo.org/security/en/glsa/glsa-200712-25.xml
- http://lists.opensuse.org/opensuse-security-announce/2007-12/msg00005.html
- http://secunia.com/advisories/28039
- http://secunia.com/advisories/28286
- http://www.redhat.com/archives/fedora-package-announce/2007-December/msg00134.html
- http://www.redhat.com/archives/fedora-package-announce/2007-December/msg00155.html
- http://www.redhat.com/archives/fedora-package-announce/2007-December/msg00281.html
- http://secunia.com/advisories/27972
- https://www.redhat.com/archives/fedora-package-announce/2008-January/msg00753.html
- https://www.redhat.com/archives/fedora-package-announce/2008-January/msg00678.html
- http://secunia.com/advisories/28585
- http://sunsolve.sun.com/search/document.do?assetkey=1-66-200637-1
- http://www.redhat.com/support/errata/RHSA-2008-0158.html
- http://www.redhat.com/support/errata/RHSA-2008-0151.html
- http://www.redhat.com/support/errata/RHSA-2008-0213.html
- http://www.mandriva.com/security/advisories?name=MDVSA-2008:095
- http://www.ubuntu.com/usn/usn-609-1
- http://secunia.com/advisories/30100
- http://www.vupen.com/english/advisories/2007/4146
- http://www.vupen.com/english/advisories/2007/4092
- https://exchange.xforce.ibmcloud.com/vulnerabilities/38882
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10153
- http://wiki.services.openoffice.org/wiki/OOoRelease231
- http://rhn.redhat.com/errata/RHSA-2007-1048.html
- http://rhn.redhat.com/errata/RHSA-2007-1090.html
- https://admin.fedoraproject.org/updates/F7/FEDORA-2007-4120
- https://admin.fedoraproject.org/updates/F8/FEDORA-2007-4172
- https://bugzilla.redhat.com/show_bug.cgi?id=299801
- https://www.cve.org/CVERecord?id=CVE-2007-4575 https://nvd.nist.gov/vuln/detail/CVE-2007-4575
- https://access.redhat.com/errata/RHSA-2008:0151
- https://access.redhat.com/errata/RHSA-2008:0213
- https://access.redhat.com/errata/RHSA-2007:1090
- https://access.redhat.com/errata/RHSA-2007:1048
- https://access.redhat.com/errata/RHSA-2008:0158
- https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2007-4575.json
Parent vulnerabilities
(Appears in the following advisories)
- collector/nvd-historical
- collector/nvd-index
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2007-4575
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- agent/last-modified-date
- agent/author
- agent/references
- agent/severity
- agent/remedy
- agent/weakness
- agent/description
- collector/redhat-cve
- agent/software-canonical-lookup
- agent/tags
- agent/event
- collector/mitre-cve
- source/MITRE
- vendor/openoffice
- canonical/openoffice openoffice
- version/openoffice openoffice/2.1
- version/openoffice openoffice/2.2
- version/openoffice openoffice/2.0.3_1
- version/openoffice openoffice/2.2.1
- version/openoffice openoffice/2.0.4
- version/openoffice openoffice/2.3
- version/openoffice openoffice/2.0.3
- version/openoffice openoffice/2.0beta
- version/openoffice openoffice/2.0.1
- version/openoffice openoffice/2.0.2
- package-manager/redhat