| <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> |
| |
| <html xmlns="http://www.w3.org/1999/xhtml"> |
| <head profile="http://www.w3.org/2005/10/profile"> |
| <title>CVE-2012-2149</title> |
| <style type="text/css"></style> |
| </head> |
| |
| <body> |
| <h2><a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=2012-2149">CVE-2012-2149</a></h2> |
| |
| <h3> |
| OpenOffice.org memory overwrite vulnerability |
| </h3> |
| |
| <ul> |
| |
| <h4>Severity: Important</h4> |
| |
| <h4>Vendor: The Apache Software Foundation</h4> |
| |
| <h4>Versions Affected:</h4> |
| <ul> |
| <li>OpenOffice.org 3.3 and 3.4 Beta, on all platforms.</li> |
| <li>Earlier versions may be also affected.</li> |
| </ul> |
| |
| |
| <h4>Description:</h4> |
| <p> |
| Effected versions of OpenOffice.org use a customized libwpd that has a memory overwrite vulnerability that could be exploited by |
| a specially crafted Wordperfect WPD-format document, potentially leading to arbitrary-code execution at application user privilege level.</p> |
| |
| <h4>Mitigation</h4> |
| <p>OpenOffice.org 3.3.0 and 3.4 beta users are advised to <a |
| href="http://download.openoffice.org">upgrade to Apache OpenOffice 3.4</a>, where |
| WPD files are ignored. Users who are unable to upgrade immediately should be |
| cautious when opening untrusted WPD documents.</p> |
| |
| <h4>Credits</h4> |
| |
| <p>The Apache OpenOffice Security Team acknowledges Kestutis Gudinavicius of SEC Consult Unternehmensberatung GmbH as the discoverer of this flaw.</p> |
| |
| <hr /> |
| |
| <p><a href="http://security.openoffice.org">Security Home</a> -> <a href="../bulletin.html">Bulletin</a> -> |
| <a href="CVE-2012-2149.html">CVE-2012-2149</a></p> |
| </body> |
| </html> |
