CVE-2010-3452: Use After Free
An integer signedness error, leading to heap-based buffer out-ouf-bounds read was found in the way OpenOffice.org processed certain Rich Text Format (RTF) tags. If a user opened a specially-crafted RTF file in OpenOffice.org suite tool (oowriter), it could lead to denial of service (oowriter executable crash), or possibly, execute arbitrary code with the privileges of the user running OpenOffice.org Writer.
References: [1] http://www.cs.brown.edu/people/drosenbe/research.html
Acknowledgements:
Red Hat would like to thank OpenOffice.org for reporting this issue. Upstream acknowledges Dan Rosenberg of Virtual Security Research as the original reporter.
Other sources
Use-after-free vulnerability in oowriter in OpenOffice.org (OOo) 2.x and 3.x before 3.3 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted tags in an RTF document.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2010-3452?
CVE-2010-3452 has a moderate severity rating due to the potential for denial of service through a crafted RTF file.
How do I fix CVE-2010-3452?
To fix CVE-2010-3452, users should update their OpenOffice.org to a version later than 3.3.0.
What software is affected by CVE-2010-3452?
CVE-2010-3452 affects versions of Apache OpenOffice between 2.0.0 and 3.3.0, as well as several versions of Debian and Ubuntu Linux.
What type of vulnerability is CVE-2010-3452?
CVE-2010-3452 is an integer signedness error resulting in a heap-based buffer out-of-bounds read.
Can CVE-2010-3452 lead to data exposure?
While CVE-2010-3452 primarily leads to denial of service, it may indirectly expose certain data upon a crash.