Description
Multiple integer overflows in OpenOffice.org (OOo) 2.0.4 and earlier, and possibly other versions before 2.1.0; and StarOffice 6 through 8; allow user-assisted remote attackers to execute arbitrary code via a crafted (a) WMF or (b) EMF file that triggers heap-based buffer overflows in (1) wmf/winwmf.cxx, during processing of META_ESCAPE records; and wmf/enhwmf.cxx, during processing of (2) EMR_POLYPOLYGON and (3) EMR_POLYPOLYGON16 records.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.1 | openoffice.org | 1.1.3-9sarge4 | DSA-1246-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | openoffice.org +3 | 1.1.5-6.6.0.EL4 | RHSA-2007:0001 |
| RHEL 3 | openoffice.org +2 | 1.1.2-35.2.0.EL3 | RHSA-2007:0001 |
Advisories 2
- RHSA-2007:0001 Red Hat Security Advisory: openoffice.org security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1246-1 openoffice.org Debian Security (DSA / DLA) · Mar 9, 2026
References
- oval:org.mitre.oval:def:9145 vdb-entry signature
- http://www.openoffice.org/issues/show_bug.cgi?id=70042
- 23683 third-party-advisory
- http://www.ngssoftware.com/advisories/high-risk-vulnerabilities-in-the-staroffice-suite/
- 23682 third-party-advisory
- 32611 vdb-entry
- 20070104 Correction (High Risk Vulnerability in the OpenOffice and StarOffice Suites) mailing-list
- 23920 third-party-advisory
- 23600 third-party-advisory
- USN-406-1 vendor-advisory
- VU#220288 third-party-advisory
- 23612 third-party-advisory
- 102735 vendor-advisory
- SUSE-SA:2007:001 vendor-advisory
- 20070104 High Risk Vulnerability in the OpenOffice and StarOffice Suites mailing-list
- 23711 third-party-advisory
- GLSA-200701-07 vendor-advisory
- 32610 vdb-entry
- ADV-2007-0031 vdb-entry
- 23712 third-party-advisory
- 20070104 Re: [VulnWatch] High Risk Vulnerability in the OpenOffice and StarOffice Suites mailing-list
- 23616 third-party-advisory
- RHSA-2007:0001 vendor-advisory
- FEDORA-2007-005 vendor-advisory
- https://issues.rpath.com/browse/RPL-905
- http://www.openoffice.org/nonav/issues/showattachment.cgi/39509/alloc.overflows.wmf.patch
- 20070104 Re: [VulnWatch] High Risk Vulnerability in the OpenOffice and StarOffice Suites mailing-list
- oval:org.mitre.oval:def:8280 vdb-entry signature
- 23620 third-party-advisory
- openoffice-wmf-bo(31257) vdb-entry
- 23549 third-party-advisory
- ADV-2007-0059 vdb-entry
- 20070104 High Risk Vulnerability in the OpenOffice and StarOffice Suites mailing-list
- 20070108 rPSA-2007-0001-1 openoffice.org mailing-list
- DSA-1246 vendor-advisory
- MDKSA-2007:006 vendor-advisory
- 1017466 vdb-entry
- 23762 third-party-advisory