CVE-2007-4575: Code Injection
HSQLDB before 1.8.0.9, as used in OpenOffice.org (OOo) 2 before 2.3.1, allows user-assisted remote attackers to execute arbitrary Java code via crafted database documents, related to "exposing static java methods."
Other sources
OpenOffice.org-base allows to execute arbitrary static public java methods. This can be misused by a remote attacker to send a victim a handcrafted odb files. The odb file execute these commands in the database bootstrap phase. Furthermore an unprivileged user can extend his privileges by using aliased methods.
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2007-4575?
CVE-2007-4575 has been rated as having a moderate severity level due to its potential to allow arbitrary code execution.
How do I fix CVE-2007-4575?
To mitigate CVE-2007-4575, upgrade HSQLDB to version 1.8.0.9 or later which addresses the code execution vulnerability.
Which software is affected by CVE-2007-4575?
CVE-2007-4575 affects versions of OpenOffice.org before 2.3.1 that utilize HSQLDB before version 1.8.0.9.
What types of attacks can CVE-2007-4575 enable?
CVE-2007-4575 can enable user-assisted remote attackers to execute arbitrary Java code through specially crafted database documents.
Is CVE-2007-4575 related to Java code execution risks?
Yes, CVE-2007-4575 specifically involves the exposure of static Java methods that facilitate the execution of arbitrary Java code.