CVE-2007-2834 Integer overflow in the TIFF parser in OpenOffice.org (OOo) before 2.3; and Sun StarOffice 6, 7, and 8 Office Suite (StarSuite); allows remote attackers to execute arbitrary code via a TIFF file with....
HighCVSS 9.3
EPSS 12.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Integer overflow in the TIFF parser in OpenOffice.org (OOo) before 2.3; and Sun StarOffice 6, 7, and 8 Office Suite (StarSuite); allows remote attackers to execute arbitrary code via a TIFF file with crafted values of unspecified length fields, which triggers allocation of an incorrect amount of memory, resulting in a heap-based buffer overflow.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache openoffice | < 2.3.0 | 2.3.0 |
| sun staroffice | = 6.0 | No fix listed |
| sun staroffice | = 7.0 | No fix listed |
| sun staroffice | = 8.0 | No fix listed |
| sun starsuite | All versions | No fix listed |
| debian linux | = 3.1 | No fix listed |
| debian linux | = 4.0 | No fix listed |
| Canonical Ubuntu Linux | = 6.06 | No fix listed |
| Canonical Ubuntu Linux | = 6.10 | No fix listed |
| Canonical Ubuntu Linux | = 7.04 | No fix listed |
References
- bugs.gentoo.org issue-tracking third-party-advisory
- FEDORA-2007-2372 broken-link third-party-advisory vendor-advisory
- FEDORA-2007-700 broken-link third-party-advisory vendor-advisory
- 20070917 Multiple Vendor OpenOffice TIFF File Parsing Multiple Integer Overflow Vulnerabilities broken-link third-party-advisory
- SUSE-SA:2007:052 mailing-list third-party-advisory vendor-advisory
- 26816 third-party-advisory
- 26817 third-party-advisory
- 26839 third-party-advisory
- 26844 third-party-advisory
- 26855 third-party-advisory
- 26861 third-party-advisory
- 26891 third-party-advisory
- 26903 third-party-advisory
- 26912 third-party-advisory
- 27077 third-party-advisory
- 27087 third-party-advisory
- 27370 third-party-advisory
- GLSA-200710-24 third-party-advisory vendor-advisory
- 1018702 third-party-advisory vdb-entry
- 102994 broken-link third-party-advisory vendor-advisory
- 200190 broken-link third-party-advisory vendor-advisory
- DSA-1375 patch third-party-advisory vendor-advisory
- MDKSA-2007:186 third-party-advisory url-repurposed vendor-advisory
- www.openoffice.org patch vendor-advisory
- RHSA-2007:0848 third-party-advisory vendor-advisory
- 20070919 FLEA-2007-0056-1 openoffice.org mailing-list third-party-advisory vdb-entry
- 25690 patch third-party-advisory vdb-entry
- USN-524-1 broken-link third-party-advisory vendor-advisory
- ADV-2007-3184 third-party-advisory vdb-entry
- ADV-2007-3262 third-party-advisory vdb-entry
- openoffice-tiff-bo(36656) third-party-advisory vdb-entry
- issues.rpath.com broken-link issue-tracking third-party-advisory
- oval:org.mitre.oval:def:9967 signature third-party-advisory vdb-entry