OpenOffice < 3.4.0 Multiple Memory Corruption Vulnerabilities

NASLDB: OpenOffice < 3.4.0 Multiple Memory Corruption Vulnerabilities

General

ID: 59191
Name: OpenOffice < 3.4.0 Multiple Memory Corruption Vulnerabilities

Summary: Checks version of OpenOffice

Credits: Tenable Network Security, Inc.

Classification

Risk: –

CVSS: –
CVSS Base Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C
CVSS Temporal Vector: CVSS2#E:U/RL:OF/RC:C

Port: –
Family: Windows
Type: Local

Description

The version of OpenOffice installed on the remote host is earlier
than 3.4.0. It thus is affected by several memory corruption issues :

– An integer overflow error exists in ‘vclmi.dll’ that
can allow heap-based buffer overflows when handling
embedded image objects. (CVE-2012-1149)

– A memory overwrite error exists in ‘libwpd’ that can be
triggered when processing WordPerfect documents. This
memory overwrite may lead to arbitrary code execution.
(CVE-2012-2149)

– Memory checking errors exist in
‘filter/source/msfilter msdffimp.cxx’ that can be
triggered when processing PowerPoint graphics records.
These errors can allow denial of service attacks.
(CVE-2012-2334)