CVE-2010-2935 simpress.bin in the Impress module in OpenOffice.org (OOo) 2.x and 3.x before 3.3 does not properly handle integer values associated with dictionary property items, which allows remote attackers to ca...
HighCVSS 9.3
EPSS 7.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
simpress.bin in the Impress module in OpenOffice.org (OOo) 2.x and 3.x before 3.3 does not properly handle integer values associated with dictionary property items, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PowerPoint document that triggers a heap-based buffer overflow, related to an "integer truncation error."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| openoffice.org | = 3.2.1 | No fix listed |
References
- SUSE-SR:2010:019 vendor-advisory
- SUSE-SR:2010:024 vendor-advisory
- 40775 third-party-advisory vendor-advisory
- 41052 third-party-advisory vendor-advisory
- 41235 third-party-advisory
- 42927 third-party-advisory
- 43105 third-party-advisory
- 60799 third-party-advisory
- securityevaluators.com
- USN-1056-1 vendor-advisory
- DSA-2099 vendor-advisory
- GLSA-201408-19 vendor-advisory
- MDVSA-2010:221 vendor-advisory
- www.openoffice.org
- [dev] 20100806 Two exploitable OpenOffice.org bugs! mailing-list
- [oss-security] 20100811 CVE Request -- OpenOffice.org [two ids]: 1, integer truncation error 2, short integer overflow mailing-list
- [oss-security] 20100811 Re: CVE Request -- OpenOffice.org [two ids]: 1, integer truncation error 2, short integer overflow mailing-list
- www.oracle.com
- RHSA-2010:0643 vendor-advisory
- 1024352 vdb-entry
- 1024976 vdb-entry
- ADV-2010-2003 vdb-entry vendor-advisory
- ADV-2010-2149 vdb-entry vendor-advisory
- ADV-2010-2228 vdb-entry
- ADV-2010-2905 vdb-entry
- ADV-2011-0150 vdb-entry
- ADV-2011-0230 vdb-entry
- ADV-2011-0279 vdb-entry
- bugzilla.redhat.com
- oval:org.mitre.oval:def:12063 signature vdb-entry