Description
OpenOffice (OOo) 1.1.2 creates predictable directory names with insecure permissions during startup, which may allow local users to read or list files of other users.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 3 | openoffice.org +2 | 1.1.0-16.14.EL | RHSA-2004:446 |
Advisories 1
- RHSA-2004:446 Red Hat Security Advisory: openoffice.org security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- 11151 vdb-entry
- 12302 third-party-advisory
- 9804 vdb-entry
- 12546 third-party-advisory
- RHSA-2004:446 vendor-advisory
- 12668 third-party-advisory
- 20040910 OpenOffice World-Readable Temporary Files Disclose Files to Local Users mailing-list
- oval:org.mitre.oval:def:10294 vdb-entry signature
- http://www.openoffice.org/issues/show_bug.cgi?id=33357
- 12914 third-party-advisory
- 12932 third-party-advisory
- openofficeorg-tmpfile-insecure-permissions(17312) vdb-entry
- 1011205 vdb-entry