Description
The StgCompObjStream::Load function in OpenOffice.org OpenOffice 1.1.4 and earlier allocates memory based on 16 bit length values, but process memory using 32 bit values, which allows remote attackers to cause a denial of service and possibly execute arbitrary code via a DOC document with certain length values, which leads to a heap-based buffer overflow.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | openoffice.org +3 | 1.1.2-24.6.0.EL4 | RHSA-2005:375 |
| RHEL 3 | openoffice.org +2 | 1.1.2-24.2.0.EL3 | RHSA-2005:375 |
Advisories 1
- RHSA-2005:375 Red Hat Security Advisory: openoffice.org security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- RHSA-2005:375 vendor-advisory
- 13092 vdb-entry
- SUSE-SR:2005:021 vendor-advisory
- oval:org.mitre.oval:def:9106 vdb-entry signature
- GLSA-200504-13 vendor-advisory
- 20050412 OpenOffice DOC document Heap Overflow mailing-list
- http://www.openoffice.org/issues/show_bug.cgi?id=46388
- 17027 third-party-advisory