Editor Login | Register
Ekle

> World > Security
OpenOffice Multiple Vulnerabilities - Security - World -
CWRedLight
(Date : 17.04.2008 20:38:14)
%5


OpenOffice Multiple Vulnerabilities
ecunia Advisory: SA29852  
Release Date: 2008-04-17

Critical:
Highly critical
Impact: System access
Where: From remote
Solution Status: Vendor Patch

Software:OpenOffice 1.0.x
OpenOffice 1.1.x
OpenOffice.org 2.x

CVE reference:CVE-2007-4770 (Secunia mirror)
CVE-2007-4771 (Secunia mirror)
CVE-2007-5746 (Secunia mirror)
CVE-2007-5745 (Secunia mirror)
CVE-2007-5747 (Secunia mirror)
CVE-2008-0320 (Secunia mirror)
Description:
Some vulnerabilities have been reported in OpenOffice, which can be exploited by malicious people to potentially compromise a user"s system.

1) Multiple unspecified errors in the processing of EMF, Quattro Pro, and OLE files can be exploited to cause heap-based buffer overflows.

2) Two errors in the processing of ODF text documents containing specially crafted XForms can be exploited to corrupt heap memory.

For more information:
SA28575

Successful exploitation of the vulnerabilities may allow execution of arbitrary code.

The vulnerabilities are reported in versions prior to 2.4.

Do you have this product installed on your home computer? Scan using the free Personal Software Inspector. Check if a vulnerable version is installed on computers in your corporate network, scan using the Network Software Inspector.

Solution:
Update to version 2.4.

Provided and/or discovered by:
1) The vendor credits an anonymous researcher working with the iDefense VCP.

Original Advisory:
OpenOffice:
http://www.openoffice.org/security/cves/CVE-2007-5746.html
http://www.openoffice.org/security/cves/CVE-2007-4770.html
http://www.openoffice.org/security/cves/CVE-2007-5745.html
http://www.openoffice.org/security/cves/CVE-2008-0320.html

Other References:
SA28575:
http://secunia.com/advisories/28575/



Derecelendir
Kaynak http://secunia.com/advisories/29852/
İçerik İhbarı
Bağlantılar: bilgininefendisi.net

Open Source Document Project AUP&TOS