CVE-2010-3454: Buffer Overflow
First published: Thu Oct 07 2010(Updated: )
Array index error, leading to heap based buffer overflow (two occurrences of invalid write by one byte) was found in the way OpenOffice.org performed scanning of the typography information of certain Microsoft Word Binary File Format (.DOC) files with certain user defined list styles (WW8). If a user opened a specially-crafted DOC file in OpenOffice.org suite tool (oowriter), it could lead to denial of service (oowriter executable crash), or possibly, execute arbitrary code with the privileges of the user running OpenOffice.org Writer. References: [1] <a href="http://www.cs.brown.edu/people/drosenbe/research.html">http://www.cs.brown.edu/people/drosenbe/research.html</a> Acknowledgements: Red Hat would like to thank OpenOffice.org for reporting this issue. Upstream acknowledges Dan Rosenberg of Virtual Security Research as the original reporter.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache OpenOffice | >=2.0.0<3.3.0 | |
| Debian Debian Linux | =5.0 | |
| Canonical Ubuntu Linux | =10.10 | |
| Debian Debian Linux | =6.0 | |
| Canonical Ubuntu Linux | =9.10 | |
| Canonical Ubuntu Linux | =10.04 | |
| Canonical Ubuntu Linux | =8.04 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.cs.brown.edu/people/drosenbe/research.html
- http://www.openoffice.org/security/cves/CVE-2010-3453_CVE-2010-3454.html
- https://rhn.redhat.com/errata/RHSA-2011-0181.html
- https://rhn.redhat.com/errata/RHSA-2011-0182.html
- https://rhn.redhat.com/errata/RHSA-2011-0183.html
- https://bugzilla.redhat.com/show_bug.cgi?id=640954
- http://secunia.com/advisories/43065
- http://www.vupen.com/english/advisories/2011/0232
- http://www.securityfocus.com/bid/46031
- http://www.vupen.com/english/advisories/2011/0230
- http://www.debian.org/security/2011/dsa-2151
- http://secunia.com/advisories/42999
- http://secunia.com/advisories/43105
- http://www.redhat.com/support/errata/RHSA-2011-0182.html
- http://www.securitytracker.com/id?1025002
- http://ubuntu.com/usn/usn-1056-1
- http://www.redhat.com/support/errata/RHSA-2011-0181.html
- http://secunia.com/advisories/43118
- http://osvdb.org/70715
- http://www.vupen.com/english/advisories/2011/0279
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:027
- http://www.oracle.com/technetwork/topics/security/cpuapr2011-301950.html
- http://www.vsecurity.com/resources/advisory/20110126-1
- http://www.gentoo.org/security/en/glsa/glsa-201408-19.xml
- http://secunia.com/advisories/60799
- http://secunia.com/advisories/40775
- collector/redhat-bugzilla
- alias/CVE-2010-3454
- agent/references
- agent/weakness
- agent/type
- agent/event
- agent/severity
- agent/author
- agent/description
- agent/softwarecombine
- agent/first-publish-date
- agent/last-modified-date
- agent/tags
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/apache
- canonical/apache openoffice
- version/apache openoffice/2.0.0
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/5.0
- vendor/canonical
- canonical/canonical ubuntu linux
- version/canonical ubuntu linux/10.10
- version/debian debian linux/6.0
- version/canonical ubuntu linux/9.10
- version/canonical ubuntu linux/10.04
- version/canonical ubuntu linux/8.04