CVE-2010-3451: Buffer Overflow
An array index error, leading to heap based buffer overflow, was found in the way OpenOffice.org parsed RTF files. If a user opened a specially-crafted RTF file, with broken RTF tables, in OpenOffice.org suite tool (oowriter), it could lead to denial of service (oowriter executable crash), or, possibly, execute arbitrary code with the privileges of the user running OpenOffice.org Writer.
References: [1] http://www.cs.brown.edu/people/drosenbe/research.html
Acknowledgements:
Red Hat would like to thank OpenOffice.org for reporting this issue. Upstream acknowledges Dan Rosenberg of Virtual Security Research as the original reporter.
Other sources
Use-after-free vulnerability in oowriter in OpenOffice.org (OOo) 2.x and 3.x before 3.3 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via malformed tables in an RTF document.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2010-3451?
CVE-2010-3451 is classified as a high-severity vulnerability due to its potential for causing denial of service through a crash of OpenOffice.org.
How do I fix CVE-2010-3451?
To fix CVE-2010-3451, update your OpenOffice.org version to 3.3.0 or later.
What versions of OpenOffice.org are affected by CVE-2010-3451?
CVE-2010-3451 affects all versions of OpenOffice.org from 2.0.0 up to 3.2.999.
What happens if I open a malicious RTF file related to CVE-2010-3451?
Opening a malicious RTF file with CVE-2010-3451 can cause OpenOffice.org's Writer tool (oowriter) to crash.
Which operating systems are impacted by CVE-2010-3451?
CVE-2010-3451 impacts multiple operating systems, including various versions of Debian and Ubuntu distributions.