PT-2010-1162 · Oracle+2 · Openoffice.Org+2

Jan Lieskovsky · Published 2010-08-23 · Updated 2024-06-15 · CVE-2010-2936

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions OpenOffice.org versions 2.x through 3.x before 3.3

Description The issue is related to an integer overflow in the Impress module, which can be triggered by crafted polygons in a PowerPoint document. This can lead to a denial of service, causing the application to crash, or possibly allow the execution of arbitrary code. The vulnerability can also be exploited to access confidential data, compromise its integrity, and disrupt service.

Recommendations For versions 2.x through 3.x before 3.3, update to version 3.3 or later to resolve the issue. As a temporary workaround, consider avoiding the use of crafted polygons in PowerPoint documents to minimize the risk of exploitation. Restrict access to untrusted documents to prevent potential attacks.

Fix

DoS

Weakness Enumeration

CWE-189

Related Identifiers

BDU:2020-02895

CVE-2010-2936

DSA-2099-1

OPENSUSE-SU-2024:10006-1

RHSA-2010:0643

RHSA-2010_0643

Affected Products

Openoffice

Openoffice.Org

Red Hat

References · 56

• https://security-tracker.debian.org/tracker/CVE-2010-2936 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10006-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00006.html · Vendor Advisory
• http://secunia.com/advisories/40775 · Vendor Advisory
• http://vupen.com/english/advisories/2010/2149 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2010:221 · Vendor Advisory
• http://debian.org/security/2010/dsa-2099 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2010-0643.html · Vendor Advisory
• http://ubuntu.com/usn/usn-1056-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-02894 · Security Note
• http://secunia.com/advisories/41052 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-2936 · Security Note
• http://gentoo.org/security/en/glsa/glsa-201408-19.xml · Vendor Advisory
• http://vupen.com/english/advisories/2010/2003 · Vendor Advisory