PT-2007-4144 · Apache+2 · Openoffice.Org+2

Published 2007-09-18 · Updated 2022-02-07 · CVE-2007-2834

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions OpenOffice.org versions prior to 2.3 Sun StarOffice versions 6, 7, and 8

Description The issue is related to an integer overflow in the TIFF parser, which allows remote attackers to execute arbitrary code via a TIFF file with crafted values of unspecified length fields. This triggers allocation of an incorrect amount of memory, resulting in a heap-based buffer overflow.

Recommendations For OpenOffice.org versions prior to 2.3, update to version 2.3 or later to resolve the issue. For Sun StarOffice versions 6, 7, and 8, consider upgrading to a newer version that is not affected by this issue, as these versions are vulnerable.

Fix

RCE

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

CVE-2007-2834

DSA-1375-1

RHSA-2007:0848

RHSA-2007_0848

Affected Products

Openoffice.Org

Red Hat

Staroffice

References · 36

• http://sunsolve.sun.com/search/document.do?assetkey=1-66-200190-1 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2007:186 · Vendor Advisory
• http://openoffice.org/security/cves/CVE-2007-2834.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-2834 · Security Note
• http://fedoranews.org/updates/FEDORA-2007-237.shtml · Vendor Advisory
• http://securityfocus.com/bid/25690 · Patch
• http://security.gentoo.org/glsa/glsa-200710-24.xml · Vendor Advisory
• http://fedoranews.org/updates/FEDORA-2007-700.shtml · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2007-09/msg00002.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2007-0848.html · Vendor Advisory
• http://ubuntu.com/usn/usn-524-1 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-102994-1 · Vendor Advisory
• http://secunia.com/advisories/27077 · Note
• http://secunia.com/advisories/26817 · Note
• http://secunia.com/advisories/26816 · Note