Heap-based buffer overflow in svtools/source/filter.vcl/wmf/enhwmf.cxx in Go-oo 2.x and 3.x before 3.0.1, previously named ooo-build and related to OpenOffice.org (OOo), allows remote attackers to execute arbitrary code via a crafted EMF file, a similar issue to CVE-2008-2238.

This updates provides a new OpenOffice.org version 3.1.1. It holds security and bug fixes described as follow :

An integer underflow might allow remote attackers to execute arbitrary code via crafted records in the document table of a Word document, leading to a heap-based buffer overflow (CVE-2009-0200).

A heap-based buffer overflow might allow remote attackers to execute arbitrary code via unspecified records in a crafted Word document, related to table parsing (CVE-2009-0201).

A heap-based buffer overflow allows remote attackers to execute arbitrary code via a crafted EMF file (CVE-2009-2139).

Multiple heap-based buffer overflows allow remote attackers to execute arbitrary code via a crafted EMF+ file (CVE-2009-2140).

OpenOffice's xmlsec uses a bundled Libtool which might load .la file in the current working directory allowing local users to gain privileges via a Trojan horse file. For enabling such vulnerability xmlsec has to use --enable-crypto_dl building flag however it does not, although the fix keeps protected against this threat whenever that flag had been enabled (CVE-2009-3736).

Further this update provides following bug fixes :

OpenOffice.org is not properly configure to use the xdg-email functionality of the FreeDesktop standard (#52195).

As the template desktop icons are not properly set, it's not presented under the context menu of applications like Dolphin (#56439).

The Firefox plugin which enables viewing of OpenOffice documents inside the browser was not enabled.

This updates provides a new OpenOffice.org version 3.1.1. It holds security and bug fixes described as follow :

An integer underflow might allow remote attackers to execute arbitrary code via crafted records in the document table of a Word document, leading to a heap-based buffer overflow (CVE-2009-0200).

A heap-based buffer overflow might allow remote attackers to execute arbitrary code via unspecified records in a crafted Word document, related to table parsing (CVE-2009-0201).

A heap-based buffer overflow allows remote attackers to execute arbitrary code via a crafted EMF file (CVE-2009-2139).

Multiple heap-based buffer overflows allow remote attackers to execute arbitrary code via a crafted EMF+ file (CVE-2009-2140).

OpenOffice's xmlsec uses a bundled Libtool which might load .la file in the current working directory allowing local users to gain privileges via a Trojan horse file. For enabling such vulnerability xmlsec has to use --enable-crypto_dl building flag however it does not, although the fix keeps protected against this threat whenever that flag had been enabled (CVE-2009-3736).

Addittionaly this update provides following bug fixes :

OpenOffice.org is not properly configure to use the xdg-email functionality of the FreeDesktop standard (#52195).

Template desktop icons are not properly set up then they are not presented under the context menu of applications like Dolphin (#56439).

libia_ora-gnome is added as suggest as long as that package is needed for a better look (#57385#c28).

It is enabled a fallback logic to properly select an OpenOffice.org style whenever one is set up but that is not installed (#57530#c1, #53284, #45133, #39043)

It is enabled the Firefox plugin for viewing OpenOffice.org documents inside browser.

Further packages were provided to supply OpenOffice.org. 3.1.1 dependencies.

Several vulnerabilities have been discovered in the OpenOffice.org office suite. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-0200     Dyon Balding of Secunia Research has discovered a     vulnerability, which can be exploited by opening a     specially crafted Microsoft Word document.

  When reading a Microsoft Word document, a bug in the parser of   sprmTDelete records can result in an integer underflow that may lead   to heap-based buffer overflows.

  Successful exploitation may allow arbitrary code execution in the   context of the OpenOffice.org process.

  - CVE-2009-0201     Dyon Balding of Secunia Research has discovered a     vulnerability, which can be exploited by opening a     specially crafted Microsoft Word document.

  When reading a Microsoft Word document, a bug in the parser of   sprmTDelete records can result in heap-based buffer overflows.

  Successful exploitation may allow arbitrary code execution in the   context of the OpenOffice.org process.

  - CVE-2009-2139     A vulnerability has been discovered in the parser of EMF     files of OpenOffice/Go-oo 2.x and 3.x that can be     triggered by a specially crafted document and lead to     the execution of arbitrary commands the privileges of     the user running OpenOffice.org/Go-oo.

  This vulnerability does not exist in the packages for oldstable,   testing and unstable.

Dyon Balding discovered flaws in the way OpenOffice.org handled tables. If a user were tricked into opening a specially crafted Word document, a remote attacker might be able to execute arbitrary code with user privileges. (CVE-2009-0200, CVE-2009-0201)

A memory overflow flaw was discovered in OpenOffice.org's handling of EMF files. If a user were tricked into opening a specially crafted document, a remote attacker might be able to execute arbitrary code with user privileges. (CVE-2009-2139).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update of OpenOffice.org fixes potential buffer overflow in EMF parser code (CVE-2009-2139, CVE-2009-2140) (Thanks to Petr Mladek).
Additionally Secunia reported an integer underflow (CVE-2009-0200) and a buffer overflow (CVE-2009-0201) that could be triggered while parsing Word documents.

The version of OpenOffice is earlier than 3.1.1.  Such versions are potentially affected by several issues : 

  - A boundary error when parsing certain records can be exploited to cause a heap-based buffer overflow via a specially crafted document. (CVE-2009-0201)

  - An integer underflow error when parsing certain records in the document table. (CVE-2009-0200)

  - A vulnerability in the parser of EMFS files can lead to the execution of arbitrary commands. (CVE-2009-2139)

ID	Name	Product	Family	Severity
48172	Mandriva Linux Security Advisory : openoffice.org (MDVSA-2010:035)	Nessus	Mandriva Local Security Checks	high
46699	Mandriva Linux Security Advisory : openoffice.org (MDVSA-2010:105)	Nessus	Mandriva Local Security Checks	high
44745	Debian DSA-1880-1 : openoffice.org - several vulnerabilities	Nessus	Debian Local Security Checks	high
41969	Ubuntu 8.04 LTS / 8.10 / 9.04 : openoffice.org vulnerabilities (USN-840-1)	Nessus	Ubuntu Local Security Checks	high
40881	openSUSE Security Update : OpenOffice_org (OpenOffice_org-1187)	Nessus	SuSE Local Security Checks	high
5145	OpenOffice < 3.1.1 Multiple Vulnerabilities	Nessus Network Monitor	Generic	medium

Detections

Analytics

CVE-2009-2139

high

Tenable Plugins

high

high

high

high

high

medium