CVE-2021-33035: Buffer overflow from a crafted DBF file
First published: Thu Sep 23 2021(Updated: )
Apache OpenOffice opens dBase/DBF documents and shows the contents as spreadsheets. DBF are database files with data organized in fields. When reading DBF data the size of certain fields is not checked: the data is just copied into local variables. A carefully crafted document could overflow the allocated space, leading to the execution of arbitrary code by altering the contents of the program stack. This issue affects Apache OpenOffice up to and including version 4.1.10
Credit: security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache OpenOffice | <=4.1.10 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.openwall.com/lists/oss-security/2021/10/07/3
- https://github.com/apache/openoffice/commit/efddaef0151af3be16078cc4d88c6bae0f911e56#diff-ea66e734dd358922aba12ad4ba39c96bdc6cbde587d07dbc63d04daa0a30e90f
- https://lists.apache.org/thread.html/r1ab8532e11f41bc7ca057ac7e39cab25f2e1f9d5f4929788ae21c8b9@%3Cusers.openoffice.apache.org%3E
- https://lists.apache.org/thread.html/r929c0c6a53cad64a1007b878342756badbb05ddd9b8f31a6d0b424cb@%3Cannounce.apache.org%3E
- https://lists.apache.org/thread.html/r929c0c6a53cad64a1007b878342756badbb05ddd9b8f31a6d0b424cb%40%3Cannounce.apache.org%3E
- https://lists.apache.org/thread.html/r1ab8532e11f41bc7ca057ac7e39cab25f2e1f9d5f4929788ae21c8b9%40%3Cusers.openoffice.apache.org%3E
Frequently Asked Questions
What is CVE-2021-33035?
CVE-2021-33035 is a vulnerability in Apache OpenOffice that allows crafted dBase/DBF documents to cause a buffer overflow and potentially execute arbitrary code.
How does CVE-2021-33035 affect Apache OpenOffice?
CVE-2021-33035 affects Apache OpenOffice version 4.1.10 and earlier, allowing maliciously crafted dBase/DBF documents to exploit a buffer overflow vulnerability.
What is the severity of CVE-2021-33035?
The severity of CVE-2021-33035 is high, with a CVSS score of 7.8.
How can CVE-2021-33035 be exploited?
CVE-2021-33035 can be exploited by enticing a user to open a specially crafted dBase/DBF document, which can trigger a buffer overflow and potentially execute arbitrary code.
Is there a patch available for CVE-2021-33035?
Yes, a patch for CVE-2021-33035 is available. It is recommended to update to the latest version of Apache OpenOffice to mitigate the vulnerability.
- agent/type
- agent/softwarecombine
- agent/remedy
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/severity
- agent/weakness
- agent/author
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/references
- agent/title
- agent/first-publish-date
- agent/event
- agent/tags
- vendor/apache
- canonical/apache openoffice
- version/apache openoffice/4.1.10