Multiple integer overflows in OpenOffice.org (OOo) 2.0.4 and earlier, and possibly other versions before 2.1.0; and StarOffice 6 through 8; allow user-assisted remote attackers to execute arbitrary code via a crafted (a) WMF or (b) EMF file that triggers heap-based buffer overflows in (1) wmf/winwmf.cxx, during processing of META_ESCAPE records; and wmf/enhwmf.cxx, during processing of (2) EMR_POLYPOLYGON and (3) EMR_POLYPOLYGON16 records.

StarSuite 8 (Solaris_x86): Update 18.
Date this patch was last updated by Sun : Mar/15/11

StarOffice 8 (Solaris_x86): Update 18.
Date this patch was last updated by Sun : Mar/15/11

StarSuite 8 (Solaris): Update 18.
Date this patch was last updated by Sun : Mar/15/11

StarOffice 8 (Solaris): Update 18.
Date this patch was last updated by Sun : Mar/15/11

From Red Hat Security Advisory 2007:0001 :

Updated openoffice.org packages are now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

OpenOffice.org is an office productivity suite that includes desktop applications such as a word processor, spreadsheet, presentation manager, formula editor, and drawing program.

Several integer overflow bugs were found in the OpenOffice.org WMF file processor. An attacker could create a carefully crafted WMF file that could cause OpenOffice.org to execute arbitrary code when the file was opened by a victim. (CVE-2006-5870)

All users of OpenOffice.org are advised to upgrade to these updated packages, which contain a backported fix for this issue.

Following security problem was fixed in OpenOffice_org :

  - Bufferoverflows in WMF and Enhanced WMF handling in     OpenOffice_org could be used to potentially execute code     or crash OpenOffice_org. It is necessary that the user     can be tricked to open a prepared document.
    (CVE-2006-5870)

This update also adds code to later hook in the OfficeXML converter (odf-converter.sf.net).

An integer overflow was discovered in OpenOffice.org's handling of WMF files. If a user were tricked into opening a specially crafted WMF file, an attacker could execute arbitrary code with user privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Following security problem was fixed in OpenOffice_org :

CVE-2006-5870: Bufferoverflows in WMF and Enhanced WMF handling in OpenOffice_org could be used to potentially execute code or crash OpenOffice_org. It is necessary that the user can be tricked to open a prepared document.

This update also adds code to later hook in the OfficeXML converter (odf-converter.sf.net).

Several integer overflows were discovered in the OpenOffice.org WMF file processor. An attacker could create a carefully crafted WMF file that would cause OpenOffice.org to execute arbitrary code when opened.

Updated packages are patched to address this issue.

The remote host is affected by the vulnerability described in GLSA-200701-07 (OpenOffice.org: EMF/WMF file handling vulnerabilities)

    John Heasman of NGSSoftware has discovered integer overflows in the     EMR_POLYPOLYGON and EMR_POLYPOLYGON16 processing and an error within     the handling of META_ESCAPE records.
  Impact :

    An attacker could exploit these vulnerabilities to cause heap overflows     and potentially execute arbitrary code with the privileges of the user     running OpenOffice.org by enticing the user to open a document     containing a malicious WMF/EMF file.
  Workaround :

    There is no known workaround known at this time.

Rectifies an error patch condition where by corrupt wmf/emf files with out of bounds values in the emf/wmf file could enable an attacker by constructing a malicious file to execute arbitrary code if opened in OpenOffice by a victim.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

John Heasman from Next Generation Security Software discovered a heap overflow in the handling of Windows Metafiles in OpenOffice.org, the free office suite, which could lead to a denial of service and potentially execution of arbitrary code.

Updated openoffice.org packages are now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

OpenOffice.org is an office productivity suite that includes desktop applications such as a word processor, spreadsheet, presentation manager, formula editor, and drawing program.

Several integer overflow bugs were found in the OpenOffice.org WMF file processor. An attacker could create a carefully crafted WMF file that could cause OpenOffice.org to execute arbitrary code when the file was opened by a victim. (CVE-2006-5870)

All users of OpenOffice.org are advised to upgrade to these updated packages, which contain a backported fix for this issue.

ID	Name	Product	Family	Severity
107858	Solaris 10 (x86) : 120190-23	Nessus	Solaris Local Security Checks	high
107857	Solaris 10 (x86) : 120186-23	Nessus	Solaris Local Security Checks	high
107356	Solaris 10 (sparc) : 120189-23	Nessus	Solaris Local Security Checks	high
107355	Solaris 10 (sparc) : 120185-23	Nessus	Solaris Local Security Checks	high
67433	Oracle Linux 4 : openoffice.org (ELSA-2007-0001)	Nessus	Oracle Linux Local Security Checks	high
29364	SuSE 10 Security Update : OpenOffice_org (ZYPP Patch Number 2407)	Nessus	SuSE Local Security Checks	high
27994	Ubuntu 5.10 / 6.06 LTS : openoffice.org/-amd64, openoffice.org2/-amd64 vulnerability (USN-406-1)	Nessus	Ubuntu Local Security Checks	high
27135	openSUSE 10 Security Update : OpenOffice_org (OpenOffice_org-2408)	Nessus	SuSE Local Security Checks	high
24622	Mandrake Linux Security Advisory : openoffice.org (MDKSA-2007:006)	Nessus	Mandriva Local Security Checks	high
24205	GLSA-200701-07 : OpenOffice.org: EMF/WMF file handling vulnerabilities	Nessus	Gentoo Local Security Checks	high
24184	Fedora Core 5 : openoffice.org-2.0.2-5.20.2 / Fedora Core 6 : openoffice.org-2.0.4-5.5.10 (2007-005)	Nessus	Fedora Local Security Checks	high
24006	Debian DSA-1246-1 : openoffice.org - buffer overflow	Nessus	Debian Local Security Checks	high
23993	RHEL 3 / 4 : openoffice.org (RHSA-2007:0001)	Nessus	Red Hat Local Security Checks	high
23984	CentOS 3 / 4 : openoffice.org (CESA-2007:0001)	Nessus	CentOS Local Security Checks	high

Detections

Analytics

CVE-2006-5870

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high