CVE-2010-3452: Use After Free
First published: Tue Oct 05 2010(Updated: )
An integer signedness error, leading to heap-based buffer out-ouf-bounds read was found in the way OpenOffice.org processed certain Rich Text Format (RTF) tags. If a user opened a specially-crafted RTF file in OpenOffice.org suite tool (oowriter), it could lead to denial of service (oowriter executable crash), or possibly, execute arbitrary code with the privileges of the user running OpenOffice.org Writer. References: [1] <a href="http://www.cs.brown.edu/people/drosenbe/research.html">http://www.cs.brown.edu/people/drosenbe/research.html</a> Acknowledgements: Red Hat would like to thank OpenOffice.org for reporting this issue. Upstream acknowledges Dan Rosenberg of Virtual Security Research as the original reporter.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache OpenOffice | >=2.0.0<3.3.0 | |
| Debian Debian Linux | =5.0 | |
| Canonical Ubuntu Linux | =10.10 | |
| Debian Debian Linux | =6.0 | |
| Canonical Ubuntu Linux | =9.10 | |
| Canonical Ubuntu Linux | =10.04 | |
| Canonical Ubuntu Linux | =8.04 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.cs.brown.edu/people/drosenbe/research.html
- http://www.openoffice.org/security/cves/CVE-2010-3451_CVE-2010-3452.html
- https://rhn.redhat.com/errata/RHSA-2011-0181.html
- https://rhn.redhat.com/errata/RHSA-2011-0182.html
- https://rhn.redhat.com/errata/RHSA-2011-0183.html
- https://bugzilla.redhat.com/show_bug.cgi?id=640241
- http://osvdb.org/70713
- http://secunia.com/advisories/40775
- http://secunia.com/advisories/42999
- http://secunia.com/advisories/43065
- http://secunia.com/advisories/43105
- http://secunia.com/advisories/43118
- http://secunia.com/advisories/60799
- http://ubuntu.com/usn/usn-1056-1
- http://www.debian.org/security/2011/dsa-2151
- http://www.gentoo.org/security/en/glsa/glsa-201408-19.xml
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:027
- http://www.oracle.com/technetwork/topics/security/cpuapr2011-301950.html
- http://www.redhat.com/support/errata/RHSA-2011-0181.html
- http://www.redhat.com/support/errata/RHSA-2011-0182.html
- http://www.securityfocus.com/bid/46031
- http://www.securitytracker.com/id?1025002
- http://www.vsecurity.com/resources/advisory/20110126-1
- http://www.vupen.com/english/advisories/2011/0230
- http://www.vupen.com/english/advisories/2011/0232
- http://www.vupen.com/english/advisories/2011/0279
- https://exchange.xforce.ibmcloud.com/vulnerabilities/65031
- collector/redhat-bugzilla
- alias/CVE-2010-3452
- agent/weakness
- agent/author
- agent/references
- agent/severity
- agent/type
- agent/description
- agent/last-modified-date
- agent/event
- agent/first-publish-date
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-historical
- vendor/apache
- canonical/apache openoffice
- version/apache openoffice/2.0.0
- vendor/canonical
- canonical/canonical ubuntu linux
- version/canonical ubuntu linux/8.04
- version/canonical ubuntu linux/9.10
- version/canonical ubuntu linux/10.04
- version/canonical ubuntu linux/10.10
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/5.0
- version/debian debian linux/6.0