The WW8ListManager::WW8ListManager function in oowriter in OpenOffice.org (OOo) 2.x and 3.x before 3.3 does not properly handle an unspecified number of list levels in user-defined list styles in WW8 data in a Microsoft Word document, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted .DOC file that triggers an out-of-bounds write.

The remote host is affected by the vulnerability described in GLSA-201408-19 (OpenOffice, LibreOffice: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in OpenOffice and       Libreoffice. Please review the CVE identifiers referenced below for       details.
  Impact :

    A remote attacker could entice a user to open a specially crafted file       using OpenOffice, possibly resulting in execution of arbitrary code with       the privileges of the process, a Denial of Service condition, execution       of arbitrary Python code, authentication bypass, or reading and writing       of arbitrary files.
  Workaround :

    There is no known workaround at this time.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-0183 advisory.

    - CVE-2010-4643 heap based buffer overflow when parsing TGA files
    - CVE-2010-4253 heap based buffer overflow in PPT import
    - CVE-2010-3450 directory traversal flaws in handling of XSLT jar filter       descriptions and OXT extension files
    - CVE-2010-3451 Array index error by insecure parsing of broken rtf       tables
    - CVE-2010-3452 Integer signedness error (crash) by processing certain       RTF tags
    - CVE-2010-3453 Heap-based buffer overflow by processing *.doc files       with WW8 list styles with specially-crafted count of list levels
    - CVE-2010-3454 Array index error by scanning document typography       information of certain *.doc files

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2011:0181 :

Updated openoffice.org and openoffice.org2 packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

OpenOffice.org is an office productivity suite that includes desktop applications, such as a word processor, spreadsheet application, presentation manager, formula editor, and a drawing program.

An array index error and an integer signedness error were found in the way OpenOffice.org parsed certain Rich Text Format (RTF) files. An attacker could use these flaws to create a specially crafted RTF file that, when opened, would cause OpenOffice.org to crash or, possibly, execute arbitrary code with the privileges of the user running OpenOffice.org. (CVE-2010-3451, CVE-2010-3452)

A heap-based buffer overflow flaw and an array index error were found in the way OpenOffice.org parsed certain Microsoft Office Word documents. An attacker could use these flaws to create a specially crafted Microsoft Office Word document that, when opened, would cause OpenOffice.org to crash or, possibly, execute arbitrary code with the privileges of the user running OpenOffice.org. (CVE-2010-3453, CVE-2010-3454)

A heap-based buffer overflow flaw was found in the way OpenOffice.org parsed certain TARGA (Truevision TGA) files. An attacker could use this flaw to create a specially crafted TARGA file. If a document containing this specially crafted TARGA file was opened, or if a user tried to insert the file into an existing document, it would cause OpenOffice.org to crash or, possibly, execute arbitrary code with the privileges of the user running OpenOffice.org. (CVE-2010-4643)

A directory traversal flaw was found in the way OpenOffice.org handled the installation of XSLT filter descriptions packaged in Java Archive (JAR) files, as well as the installation of OpenOffice.org Extension (.oxt) files. An attacker could use these flaws to create a specially crafted XSLT filter description or extension file that, when opened, would cause the OpenOffice.org Extension Manager to modify files accessible to the user installing the JAR or extension file.
(CVE-2010-3450)

Red Hat would like to thank OpenOffice.org for reporting the CVE-2010-3451, CVE-2010-3452, CVE-2010-3453, CVE-2010-3454, and CVE-2010-4643 issues. Upstream acknowledges Dan Rosenberg of Virtual Security Research as the original reporter of the CVE-2010-3451, CVE-2010-3452, CVE-2010-3453, and CVE-2010-3454 issues.

All OpenOffice.org users are advised to upgrade to these updated packages, which contain backported patches to correct these issues.
All running instances of OpenOffice.org applications must be restarted for this update to take effect.

An array index error and an integer signedness error were found in the way OpenOffice.org parsed certain Rich Text Format (RTF) files. An attacker could use these flaws to create a specially crafted RTF file that, when opened, would cause OpenOffice.org to crash or, possibly, execute arbitrary code with the privileges of the user running OpenOffice.org. (CVE-2010-3451, CVE-2010-3452)

A heap-based buffer overflow flaw and an array index error were found in the way OpenOffice.org parsed certain Microsoft Office Word documents. An attacker could use these flaws to create a specially crafted Microsoft Office Word document that, when opened, would cause OpenOffice.org to crash or, possibly, execute arbitrary code with the privileges of the user running OpenOffice.org. (CVE-2010-3453, CVE-2010-3454)

A heap-based buffer overflow flaw was found in the way OpenOffice.org parsed certain Microsoft Office PowerPoint files. An attacker could use this flaw to create a specially crafted Microsoft Office PowerPoint file that, when opened, would cause OpenOffice.org to crash or, possibly, execute arbitrary code with the privileges of the user running OpenOffice.org. (CVE-2010-4253)

A heap-based buffer overflow flaw was found in the way OpenOffice.org parsed certain TARGA (Truevision TGA) files. An attacker could use this flaw to create a specially crafted TARGA file. If a document containing this specially crafted TARGA file was opened, or if a user tried to insert the file into an existing document, it would cause OpenOffice.org to crash or, possibly, execute arbitrary code with the privileges of the user running OpenOffice.org. (CVE-2010-4643)

A directory traversal flaw was found in the way OpenOffice.org handled the installation of XSLT filter descriptions packaged in Java Archive (JAR) files, as well as the installation of OpenOffice.org Extension (.oxt) files. An attacker could use these flaws to create a specially crafted XSLT filter description or extension file that, when opened, would cause the OpenOffice.org Extension Manager to modify files accessible to the user installing the JAR or extension file.
(CVE-2010-3450)

A flaw was found in the script that launches OpenOffice.org. In some situations, a '.' character could be included in the LD_LIBRARY_PATH variable, allowing a local attacker to execute arbitrary code with the privileges of the user running OpenOffice.org, if that user ran OpenOffice.org from within an attacker-controlled directory.
(CVE-2010-3689)

This update also fixes the following bug :

  - OpenOffice.org did not create a lock file when opening a     file that was on a share mounted via SFTP. Additionally,     if there was a lock file, it was ignored. This could     result in data loss if a file in this situation was     opened simultaneously by another user. (BZ#671087)

All running instances of OpenOffice.org applications must be restarted for this update to take effect.

An array index error and an integer signedness error were found in the way OpenOffice.org parsed certain Rich Text Format (RTF) files. An attacker could use these flaws to create a specially crafted RTF file that, when opened, would cause OpenOffice.org to crash or, possibly, execute arbitrary code with the privileges of the user running OpenOffice.org. (CVE-2010-3451, CVE-2010-3452)

A heap-based buffer overflow flaw and an array index error were found in the way OpenOffice.org parsed certain Microsoft Office Word documents. An attacker could use these flaws to create a specially crafted Microsoft Office Word document that, when opened, would cause OpenOffice.org to crash or, possibly, execute arbitrary code with the privileges of the user running OpenOffice.org. (CVE-2010-3453, CVE-2010-3454)

A heap-based buffer overflow flaw was found in the way OpenOffice.org parsed certain Microsoft Office PowerPoint files. An attacker could use this flaw to create a specially crafted Microsoft Office PowerPoint file that, when opened, would cause OpenOffice.org to crash or, possibly, execute arbitrary code with the privileges of the user running OpenOffice.org. (CVE-2010-4253)

A heap-based buffer overflow flaw was found in the way OpenOffice.org parsed certain TARGA (Truevision TGA) files. An attacker could use this flaw to create a specially crafted TARGA file. If a document containing this specially crafted TARGA file was opened, or if a user tried to insert the file into an existing document, it would cause OpenOffice.org to crash or, possibly, execute arbitrary code with the privileges of the user running OpenOffice.org. (CVE-2010-4643)

A directory traversal flaw was found in the way OpenOffice.org handled the installation of XSLT filter descriptions packaged in Java Archive (JAR) files, as well as the installation of OpenOffice.org Extension (.oxt) files. An attacker could use these flaws to create a specially crafted XSLT filter description or extension file that, when opened, would cause the OpenOffice.org Extension Manager to modify files accessible to the user installing the JAR or extension file.
(CVE-2010-3450)

A flaw was found in the script that launches OpenOffice.org. In some situations, a '.' character could be included in the LD_LIBRARY_PATH variable, allowing a local attacker to execute arbitrary code with the privileges of the user running OpenOffice.org, if that user ran OpenOffice.org from within an attacker-controlled directory.
(CVE-2010-3689)

All running instances of OpenOffice.org applications must be restarted for this update to take effect.

An array index error and an integer signedness error were found in the way OpenOffice.org parsed certain Rich Text Format (RTF) files. An attacker could use these flaws to create a specially crafted RTF file that, when opened, would cause OpenOffice.org to crash or, possibly, execute arbitrary code with the privileges of the user running OpenOffice.org. (CVE-2010-3451, CVE-2010-3452)

A heap-based buffer overflow flaw and an array index error were found in the way OpenOffice.org parsed certain Microsoft Office Word documents. An attacker could use these flaws to create a specially crafted Microsoft Office Word document that, when opened, would cause OpenOffice.org to crash or, possibly, execute arbitrary code with the privileges of the user running OpenOffice.org. (CVE-2010-3453, CVE-2010-3454)

A heap-based buffer overflow flaw was found in the way OpenOffice.org parsed certain TARGA (Truevision TGA) files. An attacker could use this flaw to create a specially crafted TARGA file. If a document containing this specially crafted TARGA file was opened, or if a user tried to insert the file into an existing document, it would cause OpenOffice.org to crash or, possibly, execute arbitrary code with the privileges of the user running OpenOffice.org. (CVE-2010-4643)

A directory traversal flaw was found in the way OpenOffice.org handled the installation of XSLT filter descriptions packaged in Java Archive (JAR) files, as well as the installation of OpenOffice.org Extension (.oxt) files. An attacker could use these flaws to create a specially crafted XSLT filter description or extension file that, when opened, would cause the OpenOffice.org Extension Manager to modify files accessible to the user installing the JAR or extension file.
(CVE-2010-3450)

All running instances of OpenOffice.org applications must be restarted for this update to take effect.

Updated openoffice.org packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

OpenOffice.org is an office productivity suite that includes desktop applications, such as a word processor, spreadsheet application, presentation manager, formula editor, and a drawing program.

An array index error and an integer signedness error were found in the way OpenOffice.org parsed certain Rich Text Format (RTF) files. An attacker could use these flaws to create a specially crafted RTF file that, when opened, would cause OpenOffice.org to crash or, possibly, execute arbitrary code with the privileges of the user running OpenOffice.org. (CVE-2010-3451, CVE-2010-3452)

A heap-based buffer overflow flaw and an array index error were found in the way OpenOffice.org parsed certain Microsoft Office Word documents. An attacker could use these flaws to create a specially crafted Microsoft Office Word document that, when opened, would cause OpenOffice.org to crash or, possibly, execute arbitrary code with the privileges of the user running OpenOffice.org. (CVE-2010-3453, CVE-2010-3454)

A heap-based buffer overflow flaw was found in the way OpenOffice.org parsed certain Microsoft Office PowerPoint files. An attacker could use this flaw to create a specially crafted Microsoft Office PowerPoint file that, when opened, would cause OpenOffice.org to crash or, possibly, execute arbitrary code with the privileges of the user running OpenOffice.org. (CVE-2010-4253)

A heap-based buffer overflow flaw was found in the way OpenOffice.org parsed certain TARGA (Truevision TGA) files. An attacker could use this flaw to create a specially crafted TARGA file. If a document containing this specially crafted TARGA file was opened, or if a user tried to insert the file into an existing document, it would cause OpenOffice.org to crash or, possibly, execute arbitrary code with the privileges of the user running OpenOffice.org. (CVE-2010-4643)

A directory traversal flaw was found in the way OpenOffice.org handled the installation of XSLT filter descriptions packaged in Java Archive (JAR) files, as well as the installation of OpenOffice.org Extension (.oxt) files. An attacker could use these flaws to create a specially crafted XSLT filter description or extension file that, when opened, would cause the OpenOffice.org Extension Manager to modify files accessible to the user installing the JAR or extension file.
(CVE-2010-3450)

A flaw was found in the script that launches OpenOffice.org. In some situations, a '.' character could be included in the LD_LIBRARY_PATH variable, allowing a local attacker to execute arbitrary code with the privileges of the user running OpenOffice.org, if that user ran OpenOffice.org from within an attacker-controlled directory.
(CVE-2010-3689)

Red Hat would like to thank OpenOffice.org for reporting the CVE-2010-3451, CVE-2010-3452, CVE-2010-3453, CVE-2010-3454, and CVE-2010-4643 issues; and Dmitri Gribenko for reporting the CVE-2010-3689 issue. Upstream acknowledges Dan Rosenberg of Virtual Security Research as the original reporter of the CVE-2010-3451, CVE-2010-3452, CVE-2010-3453, and CVE-2010-3454 issues.

All OpenOffice.org users are advised to upgrade to these updated packages, which contain backported patches to correct these issues.
All running instances of OpenOffice.org applications must be restarted for this update to take effect.

- Thu Jan 27 2011 Caolan McNamara <caolanm at redhat.com>-     1:3.2.0-12.35

    - CVE-2010-3450 Extensions and filter package files

    - CVE-2010-3451 / CVE-2010-3452 RTF documents

    - CVE-2010-3453 / CVE-2010-3454 Word documents

    - CVE-2010-3689 LD_LIBRARY_PATH usage

    - CVE-2010-4253 PNG graphics

    - CVE-2010-4643 TGA graphics

    - Resolves: rhbz#648475 Crash in scanner dialog

    - Resolves: rhbz#657628 divide-by-zero

    - Resolves: rhbz#657718 Crash in SwObjectFormatterTxtFrm

    - Resolves: rhbz#660312 SDK setup script creates invalid       variables (dtardon)

  - Resolves: rhbz#663780 extend neon mutex locking

    - Resoves: rhbz#577525 [abrt] crash in       ImplRegionBase::~ImplRegionBase (dtardon)

  - Tue Oct 26 2010 Caolan McNamara <caolanm at redhat.com>
    - 1:3.2.0-12.34

    - Resolves: rhbz#636521 crash in undo in sc

    - Resolves: rhbz#641637 [abrt] [presentation-minimizer]       crash in OptimizationStats::GetStatusValue (dtardon)

  - make LD_PRELOAD of libsalalloc_malloc.so work again     (dtardon)

    - Resolves: rhbz#642996 [abrt]       CffSubsetterContext::readDictOp (dtardon)

    - Fri Oct 15 2010 Caolan McNamara <caolanm at       redhat.com> - 1:3.2.0-12.33

    - Resolves: rhbz#637838 Cropped pictures are displayed       in entirety in handouts (dtardon)

  - Tue Oct 12 2010 Caolan McNamara <caolanm at redhat.com>
    - 1:3.2.0-12.32

    - Resolves: rhbz#568277 workaround to avoid the crash       (dtardon)

    - Resolves: rhbz#631543 [abrt] crash on dereferencing       dangling pointer passed down from SwCalc::Str2Double       (dtardon)

  - Resolves: rhbz#631823 Line and Filling toolbar glitch on     theme change (caolanm)

  - Resolves: rhbz#637738 threading problems with using     libgcrypt via neon when libgcrypt which was initialized     by cups to be non-thread safe (caolanm)

  - Resolves: rhbz#632326 [abrt] [docx] _Construct<long,     long> crash (dtardon)

  - Fri Aug 13 2010 Caolan McNamara <caolanm at redhat.com>
    - 1:3.2.0-12.31

    - Resolves: rhbz#623800 gnome-shell/mutter focus       problems

    - Thu Aug 12 2010 Caolan McNamara <caolanm at       redhat.com> - 1:3.2.0-12.30

    - Resolves: rhbz#623609 CVE-2010-2935 CVE-2010-2936

    - Mon Aug 9 2010 Caolan McNamara <caolanm at redhat.com>
      - 1:3.2.0-12.29

    - Resolves: rhbz#601621 avoid using mmap for copying       files

    - Sun Aug 8 2010 Caolan McNamara <caolanm at redhat.com>
      - 1:3.2.0-12.28

    - Resolves: rhbz#621248 32bit events in forms on 64bit

    - Resolves rhbz#618047 Brackets incorrectly render in       presentations (dtardon)

  - Wed Aug 4 2010 Caolan McNamara <caolanm at redhat.com> -     1:3.2.0-12.27

    - Resolves: rhbz#608114 cppu-lifecycle issues (caolanm)

    - Resolves: rhbz#566831 [abrt] crash in GetFrmSize       (dtardon)

    - Resolves: rhbz#613278 [abrt] crash in SANE shutdown       (caolanm)

    - Resolves: rhbz#620390 [abrt] crash in       SfxViewFrame::GetFrame (dtardon)

    - Mon Jun 21 2010 Caolan McNamara <caolanm at       redhat.com> - 1:3.2.0-12.26

[plus 34 lines in the Changelog]

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities were discovered and corrected in OpenOffice.org :

Multiple directory traversal vulnerabilities allow remote attackers to overwrite arbitrary files via a .. (dot dot) in an entry in an XSLT JAR filter description file, an Extension (aka OXT) file, or unspecified other JAR or ZIP files (CVE-2010-3450).

Use-after-free vulnerability in oowriter allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via malformed tables in an RTF document (CVE-2010-3451).

Use-after-free vulnerability in oowriter allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted tags in an RTF document (CVE-2010-3452).

The WW8ListManager::WW8ListManager function in oowriter does not properly handle an unspecified number of list levels in user-defined list styles in WW8 data in a Microsoft Word document, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted .DOC file that triggers an out-of-bounds write (CVE-2010-3453).

Multiple off-by-one errors in the WW8DopTypography::ReadFromMem function in oowriter allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted typography information in a Microsoft Word .DOC file that triggers an out-of-bounds write (CVE-2010-3454).

soffice places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory (CVE-2010-3689).

Heap-based buffer overflow in Impress allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PNG file in an ODF or Microsoft Office document, as demonstrated by a PowerPoint (aka PPT) document (CVE-2010-4253).

Heap-based buffer overflow in Impress allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted TGA file in an ODF or Microsoft Office document (CVE-2010-4643).

OpenOffice.org packages have been updated in order to fix these issues. Additionally openoffice.org-voikko packages that require OpenOffice.org are also being provided and voikko package is upgraded from 2.0 to 2.2.1 version in MES5.1.

Updated openoffice.org and openoffice.org2 packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

OpenOffice.org is an office productivity suite that includes desktop applications, such as a word processor, spreadsheet application, presentation manager, formula editor, and a drawing program.

An array index error and an integer signedness error were found in the way OpenOffice.org parsed certain Rich Text Format (RTF) files. An attacker could use these flaws to create a specially crafted RTF file that, when opened, would cause OpenOffice.org to crash or, possibly, execute arbitrary code with the privileges of the user running OpenOffice.org. (CVE-2010-3451, CVE-2010-3452)

A heap-based buffer overflow flaw and an array index error were found in the way OpenOffice.org parsed certain Microsoft Office Word documents. An attacker could use these flaws to create a specially crafted Microsoft Office Word document that, when opened, would cause OpenOffice.org to crash or, possibly, execute arbitrary code with the privileges of the user running OpenOffice.org. (CVE-2010-3453, CVE-2010-3454)

A heap-based buffer overflow flaw was found in the way OpenOffice.org parsed certain TARGA (Truevision TGA) files. An attacker could use this flaw to create a specially crafted TARGA file. If a document containing this specially crafted TARGA file was opened, or if a user tried to insert the file into an existing document, it would cause OpenOffice.org to crash or, possibly, execute arbitrary code with the privileges of the user running OpenOffice.org. (CVE-2010-4643)

A directory traversal flaw was found in the way OpenOffice.org handled the installation of XSLT filter descriptions packaged in Java Archive (JAR) files, as well as the installation of OpenOffice.org Extension (.oxt) files. An attacker could use these flaws to create a specially crafted XSLT filter description or extension file that, when opened, would cause the OpenOffice.org Extension Manager to modify files accessible to the user installing the JAR or extension file.
(CVE-2010-3450)

Red Hat would like to thank OpenOffice.org for reporting the CVE-2010-3451, CVE-2010-3452, CVE-2010-3453, CVE-2010-3454, and CVE-2010-4643 issues. Upstream acknowledges Dan Rosenberg of Virtual Security Research as the original reporter of the CVE-2010-3451, CVE-2010-3452, CVE-2010-3453, and CVE-2010-3454 issues.

All OpenOffice.org users are advised to upgrade to these updated packages, which contain backported patches to correct these issues.
All running instances of OpenOffice.org applications must be restarted for this update to take effect.

Charlie Miller discovered several heap overflows in PPT processing. If a user or automated system were tricked into opening a specially crafted PPT document, a remote attacker could execute arbitrary code with user privileges. Ubuntu 10.10 was not affected. (CVE-2010-2935, CVE-2010-2936)

Marc Schoenefeld discovered that directory traversal was not correctly handled in XSLT, OXT, JAR, or ZIP files. If a user or automated system were tricked into opening a specially crafted document, a remote attacker overwrite arbitrary files, possibly leading to arbitrary code execution with user privileges. (CVE-2010-3450)

Dan Rosenberg discovered multiple heap overflows in RTF and DOC processing. If a user or automated system were tricked into opening a specially crafted RTF or DOC document, a remote attacker could execute arbitrary code with user privileges. (CVE-2010-3451, CVE-2010-3452, CVE-2010-3453, CVE-2010-3454)

Dmitri Gribenko discovered that OpenOffice.org did not correctly handle LD_LIBRARY_PATH in various tools. If a local attacker tricked a user or automated system into using OpenOffice.org from an attacker-controlled directory, they could execute arbitrary code with user privileges. (CVE-2010-3689)

Marc Schoenefeld discovered that OpenOffice.org did not correctly process PNG images. If a user or automated system were tricked into opening a specially crafted document, a remote attacker could execute arbitrary code with user privileges. (CVE-2010-4253)

It was discovered that OpenOffice.org did not correctly process TGA images. If a user or automated system were tricked into opening a specially crafted document, a remote attacker could execute arbitrary code with user privileges. (CVE-2010-4643).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2011:0183 advisory.

    OpenOffice.org is an office productivity suite that includes desktop     applications, such as a word processor, spreadsheet application,     presentation manager, formula editor, and a drawing program.

    An array index error and an integer signedness error were found in the way     OpenOffice.org parsed certain Rich Text Format (RTF) files. An attacker     could use these flaws to create a specially-crafted RTF file that, when     opened, would cause OpenOffice.org to crash or, possibly, execute arbitrary     code with the privileges of the user running OpenOffice.org.
    (CVE-2010-3451, CVE-2010-3452)

    A heap-based buffer overflow flaw and an array index error were found in     the way OpenOffice.org parsed certain Microsoft Office Word documents. An     attacker could use these flaws to create a specially-crafted Microsoft     Office Word document that, when opened, would cause OpenOffice.org to crash     or, possibly, execute arbitrary code with the privileges of the user     running OpenOffice.org. (CVE-2010-3453, CVE-2010-3454)

    A heap-based buffer overflow flaw was found in the way OpenOffice.org     parsed certain Microsoft Office PowerPoint files. An attacker could use     this flaw to create a specially-crafted Microsoft Office PowerPoint file     that, when opened, would cause OpenOffice.org to crash or, possibly,     execute arbitrary code with the privileges of the user running     OpenOffice.org. (CVE-2010-4253)

    A heap-based buffer overflow flaw was found in the way OpenOffice.org     parsed certain TARGA (Truevision TGA) files. An attacker could use this     flaw to create a specially-crafted TARGA file. If a document containing     this specially-crafted TARGA file was opened, or if a user tried to insert     the file into an existing document, it would cause OpenOffice.org to crash     or, possibly, execute arbitrary code with the privileges of the user     running OpenOffice.org. (CVE-2010-4643)

    A directory traversal flaw was found in the way OpenOffice.org handled the     installation of XSLT filter descriptions packaged in Java Archive (JAR)     files, as well as the installation of OpenOffice.org Extension (.oxt)     files. An attacker could use these flaws to create a specially-crafted XSLT     filter description or extension file that, when opened, would cause the     OpenOffice.org Extension Manager to modify files accessible to the user     installing the JAR or extension file. (CVE-2010-3450)

    A flaw was found in the script that launches OpenOffice.org. In some     situations, a . character could be included in the LD_LIBRARY_PATH     variable, allowing a local attacker to execute arbitrary code with the     privileges of the user running OpenOffice.org, if that user ran     OpenOffice.org from within an attacker-controlled directory.
    (CVE-2010-3689)

    Red Hat would like to thank OpenOffice.org for reporting the CVE-2010-3451,     CVE-2010-3452, CVE-2010-3453, CVE-2010-3454, and CVE-2010-4643 issues; and     Dmitri Gribenko for reporting the CVE-2010-3689 issue. Upstream     acknowledges Dan Rosenberg of Virtual Security Research as the original     reporter of the CVE-2010-3451, CVE-2010-3452, CVE-2010-3453, and     CVE-2010-3454 issues.

    This update also fixes the following bug:

    * OpenOffice.org did not create a lock file when opening a file that was on     a share mounted via SFTP. Additionally, if there was a lock file, it was     ignored. This could result in data loss if a file in this situation was     opened simultaneously by another user. (BZ#671087)

    All OpenOffice.org users are advised to upgrade to these updated packages,     which contain backported patches to correct these issues. All running     instances of OpenOffice.org applications must be restarted for this update     to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2011:0182 advisory.

  - OpenOffice.org: directory traversal flaws in handling of XSLT jar filter descriptions and OXT extension     files (CVE-2010-3450)

  - OpenOffice.org: Array index error by insecure parsing of broken rtf tables (CVE-2010-3451)

  - OpenOffice.org: Integer signedness error (crash) by processing certain RTF tags (CVE-2010-3452)

  - OpenOffice.org: Heap-based buffer overflow by processing *.doc files with WW8 list styles with specially-     crafted count of list levels (CVE-2010-3453)

  - OpenOffice.org: Array index error by scanning document typography information of certain *.doc files     (CVE-2010-3454)

  - OpenOffice.org: soffice insecure LD_LIBRARY_PATH setting (CVE-2010-3689)

  - OpenOffice.org:  heap based buffer overflow in PPT import (CVE-2010-4253)

  - OpenOffice.org: heap based buffer overflow when parsing TGA files (CVE-2010-4643)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Versions of OpenOffice earlier than 3.3 are potentially affected by several issues :

  - Issues exist relating to PowerPoint document parsing that may lead to arbitrary code execution. (CVE-2010-2935, CVE-2010-2936)

  - A directory traversal vulnerability exists in zip / jar package extraction. (CVE-2010-3450)

  - Issues exist relating to RTF document processing that may lead to arbitrary code execution. (CVE-2010-3451, CVE-2010-3452)

  - Issues exist relating to Word document processing that may lead to arbitrary code execution. (CVE-2010-3453, CVE-2010-3454)

  - The OpenOffice.org start script and other shell scripts expand the LD_LIBRARY_PATH in a way that the current directory might be searched for libraries before /lib and /usr/lib. (CVE-2010-3689)

  - Issues exist in the third party XPDF library relating to PDf processing that may allow arbitrary code execution. (CVE-2010-3702, CVE-2010-3704)

  - OpenOffice.org includes a version of LIBXML2 that is affected by multiple vulnerabilities. (CVE-2010-4008, CVE-2010-4494)

  - An issue exists with PNG file processing that may allow arbitrary code execution. (CVE-2010-4253)

  - An issue exists with TGA file processing that may allow arbitrary code execution. (CVE-2010-4643)

The version of Oracle OpenOffice.org installed on the remote host is prior to 3.3. It is, therefore, affected by several issues :

  - Issues exist relating to PowerPoint document processing     that may lead to arbitrary code execution.
    (CVE-2010-2935, CVE-2010-2936)

  - A directory traversal vulnerability exists in zip / jar     package extraction. (CVE-2010-3450)

  - Issues exist relating to RTF document processing that     may lead to arbitrary code execution. (CVE-2010-3451,     CVE-2010-3452)

  - Issues exist relating to Word document processing that     may lead to arbitrary code execution. (CVE-2010-3453,     CVE-2010-3454)

  - Issues exist in the third-party XPDF library relating     to PDF document processing that may allow arbitrary code     execution. (CVE-2010-3702, CVE-2010-3704)

  - OpenOffice.org includes a version of LIBXML2 that is     affected by multiple vulnerabilities. (CVE-2010-4008,     CVE-2010-4494)

  - An issue exists with PNG file processing that may allow     arbitrary code execution. (CVE-2010-4253)

  - An issue exists with TGA file processing that may allow     arbitrary code execution. (CVE-2010-4643)

Several security related problems have been discovered in the OpenOffice.org package that allows malformed documents to trick the system into crashes or even the execution of arbitrary code.

  - CVE-2010-3450     During an internal security audit within Red Hat, a     directory traversal vulnerability has been discovered in     the way OpenOffice.org 3.1.1 through 3.2.1 processes XML     filter files. If a local user is tricked into opening a     specially crafted OOo XML filters package file, this     problem could allow remote attackers to create or     overwrite arbitrary files belonging to local user or,     potentially, execute arbitrary code.

  - CVE-2010-3451     During his work as a consultant at Virtual Security     Research (VSR), Dan Rosenberg discovered a vulnerability     in OpenOffice.org's RTF parsing functionality. Opening a     maliciously crafted RTF document can cause an     out-of-bounds memory read into previously allocated heap     memory, which may lead to the execution of arbitrary     code.

  - CVE-2010-3452     Dan Rosenberg discovered a vulnerability in the RTF file     parser which can be leveraged by attackers to achieve     arbitrary code execution by convincing a victim to open     a maliciously crafted RTF file.

  - CVE-2010-3453     As part of his work with Virtual Security Research, Dan     Rosenberg discovered a vulnerability in the     WW8ListManager::WW8ListManager() function of     OpenOffice.org that allows a maliciously crafted file to     cause the execution of arbitrary code.

  - CVE-2010-3454     As part of his work with Virtual Security Research, Dan     Rosenberg discovered a vulnerability in the     WW8DopTypography::ReadFromMem() function in     OpenOffice.org that may be exploited by a maliciously     crafted file which allows an attacker to control program     flow and potentially execute arbitrary code.

  - CVE-2010-3689     Dmitri Gribenko discovered that the soffice script does     not treat an empty LD_LIBRARY_PATH variable like an     unset one, which may lead to the execution of arbitrary     code.

  - CVE-2010-4253     A heap based buffer overflow has been discovered with     unknown impact.

  - CVE-2010-4643     A vulnerability has been discovered in the way     OpenOffice.org handles TGA graphics which can be tricked     by a specially crafted TGA file that could cause the     program to crash due to a heap-based buffer overflow     with unknown impact.

ID	Name	Product	Family	Severity
77467	GLSA-201408-19 : OpenOffice, LibreOffice: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
75687	openSUSE Security Update : OpenOffice_org (openSUSE-SU-2011:0336-1)	Nessus	SuSE Local Security Checks	high
68190	Oracle Linux 6 : openoffice.org (ELSA-2011-0183)	Nessus	Oracle Linux Local Security Checks	high
68189	Oracle Linux 4 : openoffice.org (ELSA-2011-0181)	Nessus	Oracle Linux Local Security Checks	high
60947	Scientific Linux Security Update : openoffice.org on SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
60946	Scientific Linux Security Update : openoffice.org on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
60945	Scientific Linux Security Update : openoffice.org and openoffice.org2 on SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
53831	CentOS 5 : openoffice.org (CESA-2011:0182)	Nessus	CentOS Local Security Checks	high
53784	openSUSE Security Update : OpenOffice_org (openSUSE-SU-2011:0337-1)	Nessus	SuSE Local Security Checks	high
52738	SuSE 10 Security Update : Libreoffice (ZYPP Patch Number 7365)	Nessus	SuSE Local Security Checks	high
52735	SuSE 11.1 Security Update : Libreoffice (SAT Patch Number 4082)	Nessus	SuSE Local Security Checks	high
52004	Fedora 13 : openoffice.org-3.2.0-12.35.fc13 (2011-0837)	Nessus	Fedora Local Security Checks	high
51982	Mandriva Linux Security Advisory : openoffice.org (MDVSA-2011:027)	Nessus	Mandriva Local Security Checks	high
51887	CentOS 4 : openoffice.org / openoffice.org2 (CESA-2011:0181)	Nessus	CentOS Local Security Checks	high
51858	Ubuntu 8.04 LTS / 9.10 / 10.04 LTS / 10.10 : openoffice.org vulnerabilities (USN-1056-1)	Nessus	Ubuntu Local Security Checks	high
51827	RHEL 6 : openoffice.org (RHSA-2011:0183)	Nessus	Red Hat Local Security Checks	high
51826	RHEL 5 : openoffice.org (RHSA-2011:0182)	Nessus	Red Hat Local Security Checks	high
51825	RHEL 4 : openoffice.org and openoffice.org2 (RHSA-2011:0181)	Nessus	Red Hat Local Security Checks	high
5745	OpenOffice < 3.3 Multiple Vulnerabilities	Nessus Network Monitor	Generic	high
51773	Oracle OpenOffice.org < 3.3 Multiple Vulnerabilities	Nessus	Windows	high
51677	Debian DSA-2151-1 : openoffice.org - several vulnerabilities	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2010-3453

high

Tenable Plugins

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high