Integer overflow in the vclmi.dll module in OpenOffice.org (OOo) 3.3, 3.4 Beta, and possibly earlier, and LibreOffice before 3.5.3, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted embedded image object, as demonstrated by a JPEG image in a .DOC file, which triggers a heap-based buffer overflow.

The remote host is affected by the vulnerability described in GLSA-201408-19 (OpenOffice, LibreOffice: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in OpenOffice and       Libreoffice. Please review the CVE identifiers referenced below for       details.
  Impact :

    A remote attacker could entice a user to open a specially crafted file       using OpenOffice, possibly resulting in execution of arbitrary code with       the privileges of the process, a Denial of Service condition, execution       of arbitrary Python code, authentication bypass, or reading and writing       of arbitrary files.
  Workaround :

    There is no known workaround at this time.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2012-0705 advisory.

    - Resolves: CVE-2012-2334 Integer overflow leading to buffer overflow by       processing invalid Escher graphics records length in the Powerpoint       documents

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of IBM Lotus Symphony is a version prior to 3.0.1 Fix Pack 2.  Such versions are affected by multiple vulnerabilities :

  - Flaws exist in the way certain XML components are     processed for external entities in ODF documents.
    These flaws can be utilized to access and inject the     content of local files into an ODF document without a     user's knowledge or permission, or inject arbitrary code     that would be executed when opened by the user.
    (CVE-2012-0037)

  - An integer overflow error exists in 'vclmi.dll' that     can allow heap-based buffer overflows when handling     embedded image objects. (CVE-2012-1149)

  - Memory checking errors exist in     'filter/source/msfilter msdffimp.cxx' that can be     triggered when processing PowerPoint graphics records.
    These errors can allow denial of service attacks.
    (CVE-2012-2334)

  - Errors exist related to XML tag handling and base64     decoding that can lead to heap-based buffer overflows.
    (CVE-2012-2665)

The remote host is affected by the vulnerability described in GLSA-201209-05 (LibreOffice: Multiple vulnerabilities)

    Multiple vulnerabilities have been found in LibreOffice:
      The Microsoft Word Document parser contains an out-of-bounds read         error (CVE-2011-2713).
      The Raptor RDF parser contains an XML External Entity expansion error         (CVE-2012-0037).
      The graphic loading parser contains an integer overflow error which         could cause a heap-based buffer overflow (CVE-2012-1149).
      Multiple errors in the XML manifest handling code could cause a         heap-based buffer overflow (CVE-2012-2665).
  Impact :

    A remote attacker could entice a user to open a specially crafted       document file using LibreOffice, possibly resulting in execution of       arbitrary code with the privileges of the process or a Denial of Service       condition.
  Workaround :

    There is no known workaround at this time.

Security issues were identified and fixed in libreoffice :

An integer overflow vulnerability in the libreoffice graphic loading code could allow a remote attacker to cause a denial of service (application crash) or potentially execute arbitrary code (CVE-2012-1149).

An integer overflow flaw, leading to buffer overflow, was found in the way libreoffice processed invalid Escher graphics records length in PowerPoint documents. An attacker could provide a specially crafted PowerPoint document that, when opened, would cause libreoffice to crash or, potentially, execute arbitrary code with the privileges of the user running libreoffice (CVE-2012-2334).

libreoffice for Mandriva Linux 2011 has been upgraded to the 3.5.4 version which is not vulnerable to these issues.

OpenOffice.org is an office productivity suite that includes desktop applications, such as a word processor, spreadsheet application, presentation manager, formula editor, and a drawing program.

An integer overflow flaw, leading to a buffer overflow, was found in the way OpenOffice.org processed an invalid Escher graphics records length in Microsoft Office PowerPoint documents. An attacker could provide a specially crafted Microsoft Office PowerPoint document that, when opened, would cause OpenOffice.org to crash or, potentially, execute arbitrary code with the privileges of the user running OpenOffice.org. (CVE-2012-2334)

Multiple integer overflow flaws, leading to heap-based buffer overflows, were found in the JPEG, PNG, and BMP image file reader implementations in OpenOffice.org. An attacker could provide a specially crafted JPEG, PNG, or BMP image file that, when opened in an OpenOffice.org application, would cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application. (CVE-2012-1149)

All OpenOffice.org users are advised to upgrade to these updated packages, which contain backported patches to correct these issues.
All running instances of OpenOffice.org applications must be restarted for this update to take effect.

A stack-based buffer overflow was discovered in the Lotus Word Pro import filter in OpenOffice.org. The default compiler options for affected releases should reduce the vulnerability to a denial of service. (CVE-2011-2685)

Huzaifa Sidhpurwala discovered that OpenOffice.org could be made to crash if it opened a specially crafted Word document. (CVE-2011-2713)

Integer overflows were discovered in the graphics loading code of several different image types. If a user were tricked into opening a specially crafted file, an attacker could cause OpenOffice.org to crash or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2012-1149)

Sven Jacobi discovered an integer overflow when processing Escher graphics records. If a user were tricked into opening a specially crafted PowerPoint file, an attacker could cause OpenOffice.org to crash or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2012-2334).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Integer overflows were discovered in the graphics loading code of several different image types. If a user were tricked into opening a specially crafted file, an attacker could cause LibreOffice to crash or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2012-1149)

Sven Jacobi discovered an integer overflow when processing Escher graphics records. If a user were tricked into opening a specially crafted PowerPoint file, an attacker could cause LibreOffice to crash or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2012-2334).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that OpenOffice.org would not properly process crafted document files, possibly leading to arbitrary code execution.

  - CVE-2012-1149     Integer overflows in PNG image handling.

  - CVE-2012-2334     Integer overflow in operator new[] invocation and     heap-based buffer overflow inside the MS-ODRAW parser.

CVE-2012-1149 An integer overflow vulnerability in LibreOffice graphic loading code CVE-2012-2334 Denial of Service with malformed .ppt files

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated openoffice.org packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

OpenOffice.org is an office productivity suite that includes desktop applications, such as a word processor, spreadsheet application, presentation manager, formula editor, and a drawing program.

An integer overflow flaw, leading to a buffer overflow, was found in the way OpenOffice.org processed an invalid Escher graphics records length in Microsoft Office PowerPoint documents. An attacker could provide a specially crafted Microsoft Office PowerPoint document that, when opened, would cause OpenOffice.org to crash or, potentially, execute arbitrary code with the privileges of the user running OpenOffice.org. (CVE-2012-2334)

Multiple integer overflow flaws, leading to heap-based buffer overflows, were found in the JPEG, PNG, and BMP image file reader implementations in OpenOffice.org. An attacker could provide a specially crafted JPEG, PNG, or BMP image file that, when opened in an OpenOffice.org application, would cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application. (CVE-2012-1149)

Upstream acknowledges Sven Jacobi as the original reporter of CVE-2012-2334, and Tielei Wang via Secunia SVCRP as the original reporter of CVE-2012-1149.

All OpenOffice.org users are advised to upgrade to these updated packages, which contain backported patches to correct these issues.
All running instances of OpenOffice.org applications must be restarted for this update to take effect.

The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:0705 advisory.

    OpenOffice.org is an office productivity suite that includes desktop     applications, such as a word processor, spreadsheet application,     presentation manager, formula editor, and a drawing program.

    An integer overflow flaw, leading to a buffer overflow, was found in the     way OpenOffice.org processed an invalid Escher graphics records length in     Microsoft Office PowerPoint documents. An attacker could provide a     specially-crafted Microsoft Office PowerPoint document that, when opened,     would cause OpenOffice.org to crash or, potentially, execute arbitrary code     with the privileges of the user running OpenOffice.org. (CVE-2012-2334)

    Multiple integer overflow flaws, leading to heap-based buffer overflows,     were found in the JPEG, PNG, and BMP image file reader implementations in     OpenOffice.org. An attacker could provide a specially-crafted JPEG, PNG,     or BMP image file that, when opened in an OpenOffice.org application, would     cause the application to crash or, potentially, execute arbitrary code with     the privileges of the user running the application. (CVE-2012-1149)

    Upstream acknowledges Sven Jacobi as the original reporter of     CVE-2012-2334, and Tielei Wang via Secunia SVCRP as the original reporter     of CVE-2012-1149.

    All OpenOffice.org users are advised to upgrade to these updated packages,     which contain backported patches to correct these issues. All running     instances of OpenOffice.org applications must be restarted for this update     to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

CVE-2012-1149 An integer overflow vulnerability in LibreOffice graphic loading code

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Apache OpenOffice installed on the remote host is prior to 3.4.0. It is, therefore, affected by several memory corruption issues :

  - An integer overflow error exists in 'vclmi.dll' that     could allow heap-based buffer overflows when handling     embedded image objects. (CVE-2012-1149)

  - A memory overwrite error exists in 'libwpd' that could     be triggered when processing WordPerfect documents. This     memory overwrite may lead to arbitrary code execution.
    (CVE-2012-2149)

  - Memory checking errors exist in     'filter/source/msfilter msdffimp.cxx' that could be     triggered when processing PowerPoint graphics records.
    These errors could allow denial of service attacks.
    (CVE-2012-2334)

A version of LibreOffice prior to 3.5.3 is installed on the remote Windows host. It is, therefore, reportedly affected by multiple memory corruption vulnerabilities :

  - An integer overflow vulnerability exists in the     graphics object loading code that could allow a remote     attacker to execute arbitrary code or cause an     application crash. (CVE-2012-1149)

  - A denial of service vulnerability exists in the     PowerPoint presentation import code. (CVE-2012-2334)

  - A memory corruption vulnerability in the code for     handling .RTF files.

Tielei Wang discovered that OpenOffice.org does not allocate a large enough memory region when processing a specially crafted JPEG object, leading to a heap-based buffer overflow and potentially arbitrary code execution.

The update fixes the following security issues :

  - 740453: Vulnerability in RDF handling. (CVE-2012-0037)

  - 752595: overflow in jpeg handling (CVE-2012-1149) This     update also fixes the following non-security issues :

Extras :

  - add SUSE color palette (fate#312645) Filters :

  - crash when loading embedded elements. (bnc#693238)

  - crash when importing an empty paragraph (rh#667082)

  - more on bentConnectors. (bnc#736495)

  - wrong text color in smartArt. (bnc#746996)

  - reading of w:textbox contents. (bnc#693388)

  - textbox position and size DOCX import (fdo#45560)

  - RTF/DOCX import of transparent frames. (bnc#695479)

  - consecutive frames in RTF/DOCX import. (bnc#703032)

  - handling of frame properties in RTF import. (bnc#417818)

  - force imported XLSX active tab to be shown. (bnc#748198)

  - create TableManager for inside shapes. (bnc#747471,     bnc#693238)

  - textboxes import with OLE objects inside. (bnc#747471,     bnc#693238)

  - table style. (bnc#705991)

  - text rotation fixes. (bnc#734734)

  - crash in PPTX import. (bnc#706792)

  - read w:sdt* contents. (bnc#705949)

  - connector shape fixes. (bnc#719989)

  - legacy fragment import. (bnc#699334)

  - non-working Excel macros. (bnc#705977)

  - free drawn curves import. (bnc#657909)

  - group shape transformations. (bnc#621739)

  - extLst of drawings in diagrams import. (bnc#655408)

  - flip properties of custom shapes import. (bnc#705985)

  - line spacing is used from previous values. (bnc#734734)

  - missing ooxml customshape->mso shape name entries.
    (bnc#737921)

  - word doesn't break the numberings and prefers hiding     them (bnc#707157) Base :

  - iterator misuse (fdo #44040, bnc#742178) Writer :

  - do not use an invalidated iterator (fdo#46337)

  - field refreshing (fdo#39694)

  - more layout crashers (i#101776, fdo#39510)

  - textbox borders style and width in DOCX import     (fdo#45560)

  - expand all text fields when setting properties     (fdo#42073)

  - version 3.4.5.3, tag suse-3.4.5.3 (SUSE LO 3.4.5-rc1)

  - SmartArt import

  - custom shapes import

  - Oracle Java 1.7.0 detection

  - reading AES-encrypted ODF 1.2 documents as generated by     LO 3.5

  - frame selection. (bnc#740117)

  - crash when editing index. (bnc#726174)

  - order database properties. (bnc#740032)

  - numbering levels in DOC import. (bnc#715115)

  - image size issue in DOC import. (bnc#718971)

  - pointless forward moving of a table. (bnc#706138)

  - tabs set after the end margin in DOCX import.
    (bnc#693238)

  - add hyperlinks by default in Table of Contents     (bnc#705956) Calc :

  - pie charts colors messed in XLS import (fdo#40320)

  - correctly import data point formats in data series     (fdo#40320) Components :

  - crash when parsing XML signatures (fdo#39657)

  - broken getDataArray (fdo#46165, fdo#38441, i#117010)

  - don't paint a frame around the list of edit boxes     (fdo#42543)

  - inconsistent compression method for encrypted documents.
    (bnc#653688)

  - allow pasting to multiple ranges. (bnc#715094)

  - correctly convert chart data ranges. (bnc#727504)

  - definedName corruption for XLSX export. (bnc#741182)

  - adjust/shrink the ranges while copying. (bnc#677811)

  - extra graph data is displayed for label. (bnc#717290)

  - getCellRangeByName failure for named range. (bnc#738113)

  - graph in XLS file has dates displayed wrong.
    (bnc#720443)

  - improve performance of large Excel documents.
    (bnc#715104)

  - display page background color/image properly.
    (bnc#722045)

  - pivot table output becoming empty on re-save.
    (bnc#715543)

  - encode virtual paths to local volume correctly.
    (bnc#719887)

  - avoid adjusting cell-anchored objects on other sheets.
    (bnc#726152)

  - make sure to adjust the sheet index of drawing objects.
    (bnc#733864)

  - make the data validation popup more reliable (fdo     #36851, bnc#737190) Impress :

  - do not create an empty slide when printing handouts     (fdo#31966)

  - undo corruption. (bnc#685123)

  - do not set duplicate master slide names (bnc#735533)     Libraries :

  - default shortcut for .uno:SearchDialog should be Ctrl+H

  - crash using instances dialog of dataform navigator     (fdo#44816)

  - disable problematic reading of external entities in     raptor

  - correctly calculate leap year

  - use proper Indian Rupee currency symbol U+20B9     (rh#794679)

  - handle copy and paste from ConsoleOne. (bnc#704274)

  - VBA control events not working, broken eventattacher.
    (bnc#718227)

  - 'General Error' when double-click graphic in     presentation. (bnc#720948)

  - upgrade graphite to 1.0.3 fix surrogate support

  - crash at exit. (bnc#728603)

  - radial gradient offset. (bnc#714787)

  - horizontal scrollbars with KDE oxygen style.
    (bnc#722918)

  - rendering of metafiles embedded in EMF+ (updated)     (bnc#705956) Postprocess :

  - make the 3D transitions work again (bnc#728559) URE :

  - make Duden Korrektor 5 and 6 work General :

  - add compat symlinks for the old main desktop icon.
    (bnc#724087)

  - Fix tooltips are all black in KDE4 (bnc#723074,     fdo#40461)

  - do-not-display-math-in-desktop-menu.diff: do not display     math in desktop menu (fdo#41681)

  - desktop-submenu.diff: display LO application in the     right desktop submenu. (bnc#718694)

  - bash-completion-for-loffice.diff: define bash completion     for 'loffice' wrapper. (bnc#719656)

  - svx-globlmn-hrc-build-dep.diff: fix build dependency     problem in svx

  - Update gdocs extension to version 3.0.0; needed to make     it working with the current Google Docs interface

LibreOffice 3.4.5 includes many fixes over the previous LibreOffice 3.4.2.6 update.

The update fixes the following security issues :

  - 740453: Vulnerability in RDF handling. (CVE-2012-0037)

  - 752595: overflow in jpeg handling. (CVE-2012-1149)

  - 736146: buffer overflow in the build in icu copy     (736146) This update also fixes the following     non-security issues :

Extras :

  - add SUSE color palette (fate#312645) Filters :

  - crash when loading embedded elements. (bnc#693238)

  - crash when importing an empty paragraph (rh#667082)

  - more on bentConnectors. (bnc#736495)

  - wrong text color in smartArt. (bnc#746996)

  - reading of w:textbox contents. (bnc#693388)

  - textbox position and size DOCX import (fdo#45560)

  - RTF/DOCX import of transparent frames. (bnc#695479)

  - consecutive frames in RTF/DOCX import. (bnc#703032)

  - handling of frame properties in RTF import. (bnc#417818)

  - force imported XLSX active tab to be shown. (bnc#748198)

  - create TableManager for inside shapes. (bnc#747471,     bnc#693238)

  - textboxes import with OLE objects inside. (bnc#747471,     bnc#693238)

  - table style. (bnc#705991)

  - text rotation fixes. (bnc#734734)

  - crash in PPTX import. (bnc#706792)

  - read w:sdt* contents. (bnc#705949)

  - connector shape fixes. (bnc#719989)

  - legacy fragment import. (bnc#699334)

  - non-working Excel macros. (bnc#705977)

  - free drawn curves import. (bnc#657909)

  - group shape transformations. (bnc#621739)

  - extLst of drawings in diagrams import. (bnc#655408)

  - flip properties of custom shapes import. (bnc#705985)

  - line spacing is used from previous values. (bnc#734734)

  - missing ooxml customshape->mso shape name entries.
    (bnc#737921)

  - word doesn't break the numberings and prefers hiding     them. (bnc#707157)

Base :

  - iterator misuse (fdo #44040, bnc#742178) Writer :

  - do not use an invalidated iterator (fdo#46337)

  - field refreshing (fdo#39694)

  - more layout crashers (i#101776, fdo#39510)

  - textbox borders style and width in DOCX import     (fdo#45560)

  - expand all text fields when setting properties     (fdo#42073)

  - version 3.4.5.3, tag suse-3.4.5.3 (SUSE LO 3.4.5-rc1)

  - SmartArt import

  - custom shapes import

  - Oracle Java 1.7.0 detection

  - reading AES-encrypted ODF 1.2 documents as generated by     LO 3.5

  - frame selection. (bnc#740117)

  - crash when editing index. (bnc#726174)

  - order database properties. (bnc#740032)

  - numbering levels in DOC import. (bnc#715115)

  - image size issue in DOC import. (bnc#718971)

  - pointless forward moving of a table. (bnc#706138)

  - tabs set after the end margin in DOCX import.
    (bnc#693238)

  - add hyperlinks by default in Table of Contents     (bnc#705956) Calc :

  - pie charts colors messed in XLS import (fdo#40320)

  - correctly import data point formats in data series     (fdo#40320) Components :

  - crash when parsing XML signatures (fdo#39657)

  - broken getDataArray (fdo#46165, fdo#38441, i#117010)

  - don't paint a frame around the list of edit boxes     (fdo#42543)

  - inconsistent compression method for encrypted documents.
    (bnc#653688)

  - allow pasting to multiple ranges. (bnc#715094)

  - correctly convert chart data ranges. (bnc#727504)

  - definedName corruption for XLSX export. (bnc#741182)

  - adjust/shrink the ranges while copying. (bnc#677811)

  - extra graph data is displayed for label. (bnc#717290)

  - getCellRangeByName failure for named range. (bnc#738113)

  - graph in XLS file has dates displayed wrong.
    (bnc#720443)

  - improve performance of large Excel documents.
    (bnc#715104)

  - display page background color/image properly.
    (bnc#722045)

  - pivot table output becoming empty on re-save.
    (bnc#715543)

  - encode virtual paths to local volume correctly.
    (bnc#719887)

  - avoid adjusting cell-anchored objects on other sheets.
    (bnc#726152)

  - make sure to adjust the sheet index of drawing objects.
    (bnc#733864)

  - make the data validation popup more reliable (fdo     #36851, bnc#737190) Impress :

  - do not create an empty slide when printing handouts     (fdo#31966)

  - undo corruption. (bnc#685123)

  - do not set duplicate master slide names (bnc#735533)     Libraries :

  - default shortcut for .uno:SearchDialog should be Ctrl+H

  - crash using instances dialog of dataform navigator     (fdo#44816)

  - disable problematic reading of external entities in     raptor

  - correctly calculate leap year

  - use proper Indian Rupee currency symbol U+20B9     (rh#794679)

  - handle copy and paste from ConsoleOne. (bnc#704274)

  - VBA control events not working, broken eventattacher.
    (bnc#718227)

  - 'General Error' when double-click graphic in     presentation. (bnc#720948)

  - upgrade graphite to 1.0.3 fix surrogate support

  - crash at exit. (bnc#728603)

  - radial gradient offset. (bnc#714787)

  - horizontal scrollbars with KDE oxygen style.
    (bnc#722918)

  - rendering of metafiles embedded in EMF+ (updated)     (bnc#705956) Postprocess :

  - make the 3D transitions work again (bnc#728559) URE :

  - make Duden Korrektor 5 and 6 work General :

  - add compat symlinks for the old main desktop icon.
    (bnc#724087)

  - Fix tooltips are all black in KDE4 (bnc#723074,     fdo#40461)

  - do-not-display-math-in-desktop-menu.diff: do not display     math in desktop menu (fdo#41681)

  - desktop-submenu.diff: display LO application in the     right desktop submenu. (bnc#718694)

  - bash-completion-for-loffice.diff: define bash completion     for 'loffice' wrapper. (bnc#719656)

  - svx-globlmn-hrc-build-dep.diff: fix build dependency     problem in svx

ID	Name	Product	Family	Severity
77467	GLSA-201408-19 : OpenOffice, LibreOffice: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
68534	Oracle Linux 6 : openoffice.org (ELSA-2012-0705)	Nessus	Oracle Linux Local Security Checks	critical
63266	IBM Lotus Symphony < 3.0.1 Fix Pack 2 Multiple Vulnerabilities	Nessus	Windows	high
62286	GLSA-201209-05 : LibreOffice: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
61955	Mandriva Linux Security Advisory : libreoffice (MDVSA-2012:091)	Nessus	Mandriva Local Security Checks	high
61321	Scientific Linux Security Update : openoffice.org on SL5.x, SL6.x i386/x86_64 (20120604)	Nessus	Scientific Linux Local Security Checks	high
59833	Ubuntu 10.04 LTS : openoffice.org vulnerabilities (USN-1496-1)	Nessus	Ubuntu Local Security Checks	high
59832	Ubuntu 11.04 / 11.10 : libreoffice, libreoffice-l10n vulnerabilities (USN-1495-1)	Nessus	Ubuntu Local Security Checks	high
59765	Debian DSA-2487-1 : openoffice.org - buffer overflow	Nessus	Debian Local Security Checks	high
59483	Fedora 15 : libreoffice-3.3.4.1-5.fc15 (2012-8114)	Nessus	Fedora Local Security Checks	high
59378	CentOS 5 / 6 : openoffice.org (CESA-2012:0705)	Nessus	CentOS Local Security Checks	high
59363	RHEL 5 / 6 : openoffice.org (RHSA-2012:0705)	Nessus	Red Hat Local Security Checks	critical
59274	Fedora 16 : libreoffice-3.4.5.2-15.fc16 (2012-8042)	Nessus	Fedora Local Security Checks	high
59191	Apache OpenOffice < 3.4.0 Multiple Memory Corruption Vulnerabilities	Nessus	Windows	high
59180	LibreOffice < 3.5.3 Multiple Memory Corruption Vulnerabilities	Nessus	Windows	high
59167	Debian DSA-2473-1 : openoffice.org - buffer overflow	Nessus	Debian Local Security Checks	high
58721	SuSE 11.1 Security Update : LibreOffice (SAT Patch Number 6003)	Nessus	SuSE Local Security Checks	high
58577	SuSE 10 Security Update : LibreOffice (ZYPP Patch Number 8022)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2012-1149

critical

Tenable Plugins

critical

critical

high

high

high

high

high

high

high

high

high

critical

high

high

high

high

high

high