CVE-2010-2935: Buffer Overflow
An integer truncation error, leading to heap-based buffer overflow was found in the way OpenOffice.org Impress presentation application sanitized dictionary property items of the processed file. An attacker could use this flaw to create a specially-crafted Microsoft PowerPoint (PPT) file that, when opened, would cause simpress.bin executable to crash, or, possibly execute arbitrary code with the privileges of the user running the ooimpress tool.
References: [1] http://secunia.com/advisories/40775/ [2] http://securityevaluators.com/files/papers/CrashAnalysis.pdf [3] http://www.openoffice.org/servlets/ReadMsg?list=dev&msgNo=27690
CVE Request: [4] http://www.openwall.com/lists/oss-security/2010/08/11/1
Other sources
simpress.bin in the Impress module in OpenOffice.org (OOo) 2.x and 3.x before 3.3 does not properly handle integer values associated with dictionary property items, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PowerPoint document that triggers a heap-based buffer overflow, related to an "integer truncation error."
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2010-2935?
CVE-2010-2935 is rated as a high severity vulnerability due to the potential for a heap-based buffer overflow.
How do I fix CVE-2010-2935?
To address CVE-2010-2935, you should upgrade to a patched version of OpenOffice.org that resolves this integer truncation error.
What kind of attacks can exploit CVE-2010-2935?
An attacker can exploit CVE-2010-2935 by crafting a malicious Microsoft PowerPoint file that triggers the buffer overflow when processed.
Which versions of OpenOffice.org are affected by CVE-2010-2935?
CVE-2010-2935 specifically affects OpenOffice.org version 3.2.1.
Is CVE-2010-2935 applicable to Microsoft Windows?
CVE-2010-2935 is relevant for OpenOffice.org on Microsoft Windows, but does not affect the operating system directly.