CVE-2010-3454: Buffer Overflow
Array index error, leading to heap based buffer overflow (two occurrences of invalid write by one byte) was found in the way OpenOffice.org performed scanning of the typography information of certain Microsoft Word Binary File Format (.DOC) files with certain user defined list styles (WW8). If a user opened a specially-crafted DOC file in OpenOffice.org suite tool (oowriter), it could lead to denial of service (oowriter executable crash), or possibly, execute arbitrary code with the privileges of the user running OpenOffice.org Writer.
References: [1] http://www.cs.brown.edu/people/drosenbe/research.html
Acknowledgements:
Red Hat would like to thank OpenOffice.org for reporting this issue. Upstream acknowledges Dan Rosenberg of Virtual Security Research as the original reporter.
Other sources
Multiple off-by-one errors in the WW8DopTypography::ReadFromMem function in oowriter in OpenOffice.org (OOo) 2.x and 3.x before 3.3 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted typography information in a Microsoft Word .DOC file that triggers an out-of-bounds write.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2010-3454?
CVE-2010-3454 is rated as high severity due to the potential for heap-based buffer overflow leading to code execution.
How do I fix CVE-2010-3454?
To fix CVE-2010-3454, update your Apache OpenOffice version to a patched release if available.
What types of systems are affected by CVE-2010-3454?
CVE-2010-3454 affects various versions of Apache OpenOffice on operating systems like Debian and Ubuntu.
What are the potential consequences of exploiting CVE-2010-3454?
Exploiting CVE-2010-3454 can lead to arbitrary code execution, potentially allowing an attacker to control the affected system.
Is there a workaround for CVE-2010-3454 if I cannot update immediately?
A temporary workaround for CVE-2010-3454 may involve avoiding the opening of untrusted Microsoft Word .DOC files.