Integer underflow in OpenOffice.org (OOo) before 3.1.1 and StarOffice/StarSuite 7, 8, and 9 might allow remote attackers to execute arbitrary code via crafted records in the document table of a Word document, leading to a heap-based buffer overflow.
Heap-based buffer overflow in OpenOffice.org (OOo) before 3.1.1 and StarOffice/StarSuite 7, 8, and 9 might allow remote attackers to execute arbitrary code via unspecified records in a crafted Word document, related to "table parsing."
The Word processor in OpenOffice.org 1.1.2 through 1.1.5 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted (1) .doc, (2) .wri, or (3) .rtf Word 97 file that triggers memory corruption, as exploited in the wild in December 2008, as demonstrated by 2008-crash.doc.rar, and a similar issue to CVE-2008-4841.
An integer truncation error, leading to heap-based buffer overflow was found in the way OpenOffice.org Impress presentation application sanitized dictionary property items of the processed file. An attacker could use this flaw to create a specially-crafted Microsoft PowerPoint (PPT) file that, when opened, would cause simpress.bin executable to crash, or, possibly execute arbitrary code with the privileges of the user running the ooimpress tool.
References: [1] http://secunia.com/advisories/40775/ [2] http://securityevaluators.com/files/papers/CrashAnalysis.pdf [3] http://www.openoffice.org/servlets/ReadMsg?list=dev&msgNo=27690
CVE Request: [4] http://www.openwall.com/lists/oss-security/2010/08/11/1
A short integer overflow, leading to heap-based buffer overflow was found in the way OpenOffice.org Impress presentation aplication processed polygons in input document. An attacker could use this flaw to create a specially-crafted Microsoft PowerPoint (PPT) file that, when opened, would cause simpress.bin executable to crash, or, possibly execute arbitrary code with the privileges of the user running the ooimpress tool.
References: [1] http://secunia.com/advisories/40775/ [2] http://securityevaluators.com/files/papers/CrashAnalysis.pdf [3] http://www.openoffice.org/servlets/ReadMsg?list=dev&msgNo=27690
CVE Request: [4] http://www.openwall.com/lists/oss-security/2010/08/11/1
OpenOffice.org (OOo) before 2.1.0 does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update, as demonstrated by evilgrade and DNS cache poisoning.
An integer signedness error, leading to heap-based buffer out-ouf-bounds read was found in the way OpenOffice.org processed certain Rich Text Format (RTF) tags. If a user opened a specially-crafted RTF file in OpenOffice.org suite tool (oowriter), it could lead to denial of service (oowriter executable crash), or possibly, execute arbitrary code with the privileges of the user running OpenOffice.org Writer.
References: [1] http://www.cs.brown.edu/people/drosenbe/research.html
Acknowledgements:
Red Hat would like to thank OpenOffice.org for reporting this issue. Upstream acknowledges Dan Rosenberg of Virtual Security Research as the original reporter.
A heap-based buffer overflow was found in the way OpenOffice.org imported Microsoft Word Binary File Format (.DOC) files with certain user defined list styles (WW8). If a user opened a specially-crafted DOC file in OpenOffice.org suite tool (oowriter), it could lead to denial of service (oowriter executable crash), or possibly, execute arbitrary code with the privileges of the user running OpenOffice.org Writer.
References: [1] http://www.cs.brown.edu/people/drosenbe/research.html
Acknowledgements:
Red Hat would like to thank OpenOffice.org for reporting this issue. Upstream acknowledges Dan Rosenberg of Virtual Security Research as the original reporter.
An array index error, leading to heap based buffer overflow, was found in the way OpenOffice.org parsed RTF files. If a user opened a specially-crafted RTF file, with broken RTF tables, in OpenOffice.org suite tool (oowriter), it could lead to denial of service (oowriter executable crash), or, possibly, execute arbitrary code with the privileges of the user running OpenOffice.org Writer.
References: [1] http://www.cs.brown.edu/people/drosenbe/research.html
Acknowledgements:
Red Hat would like to thank OpenOffice.org for reporting this issue. Upstream acknowledges Dan Rosenberg of Virtual Security Research as the original reporter.
A heap-based buffer overflow was discovered in various versions of OpenOffice.org, when reading certain TGA files.
If a user opened a specially crafted TGA file, it could lead to application crash or possibly execution of arbitrary code, with the privileges of the user running OpenOffice.org Impress.
This has been assigned CVE-2010-4643.
Acknowledgements:
Red Hat would like to thank OpenOffice.org for reporting this issue.
Integer overflow in OpenOffice.org before 2.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an EMF file with a crafted EMRSTRETCHBLT record, which triggers a heap-based buffer overflow.