PT-2010-1159 · Oracle+2 · Openoffice.Org+2

Nicolas Joly · Published 2010-02-12 · Updated 2022-02-07 · CVE-2009-3302

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions OpenOffice.org (OOo) versions prior to 3.2

Description The issue is related to a boundary error flaw in the filter/ww8/ww8par2.cxx component of OpenOffice.org, specifically with the handling of the sprmTSetBrc table property modifier in a Word document. This flaw can be exploited by remote attackers to cause a denial of service, potentially leading to an application crash, or possibly execute arbitrary code. The exploitation of this flaw may also allow an attacker to access confidential data, compromise its integrity, and disrupt service.

Recommendations For OpenOffice.org versions prior to 3.2, update to version 3.2 or later to resolve the issue.

Fix

DoS

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2020-02892

CVE-2009-3302

DSA-1995-1

DTSA-205-1

RHSA-2010:0101

RHSA-2010_0101

Affected Products

Openoffice

Openoffice.Org

Red Hat

References · 37

• http://debian.org/security/2010/dsa-1995 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-02811 · Security Note
• http://redhat.com/support/errata/RHSA-2010-0101.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-02892 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00005.html · Vendor Advisory
• http://openoffice.org/security/cves/CVE-2009-3301-3302.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2009-3302 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2010:221 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-02891 · Security Note
• http://ubuntu.com/usn/USN-903-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-02810 · Security Note
• http://openoffice.org/security/bulletin.html · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-201408-19.xml · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-3302 · Security Note
• http://us-cert.gov/cas/techalerts/TA10-287A.html · Note