Description
OpenOffice.org 2.x and 3.0 before 3.2.1 allows user-assisted remote attackers to bypass Python macro security restrictions and execute arbitrary Python code via a crafted OpenDocument Text (ODT) file that triggers code execution when the macro directory structure is previewed.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | openoffice.org | 1:2.4.1+dfsg-1+lenny7 | DSA-2055-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | openoffice.org +77 | 1:3.1.1-19.5.el5_5.1 | RHSA-2010:0459 |
| RHEL 4 | openoffice.org2 +58 | 1:2.0.4-5.7.0.6.1.el4_8.4 | RHSA-2010:0459 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Productivity 5 | openoffice.org +75 | 1:3.1.1-19.5.el5_5.1 | RHSA-2010:0459 |
Advisories 2
- RHSA-2010:0459 Red Hat Security Advisory: openoffice.org security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2055-1 openoffice.org - arbitrary code execution Debian Security (DSA / DLA) · Mar 9, 2026
References
- MDVSA-2010:221 vendor-advisory
- 60799 third-party-advisory
- GLSA-201408-19 vendor-advisory
- FEDORA-2010-9633 vendor-advisory
- 40070 third-party-advisory
- ADV-2010-1369 vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=574119
- ADV-2010-1350 vdb-entry
- 40084 third-party-advisory
- ADV-2010-1366 vdb-entry
- DSA-2055 vendor-advisory
- http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html
- RHSA-2010:0459 vendor-advisory
- 40104 third-party-advisory
- ADV-2010-1353 vdb-entry
- SUSE-SR:2010:014 vendor-advisory
- oval:org.mitre.oval:def:11091 vdb-entry signature
- FEDORA-2010-9576 vendor-advisory
- 41818 third-party-advisory
- TA10-287A third-party-advisory
- USN-949-1 vendor-advisory
- FEDORA-2010-9628 vendor-advisory
- 40107 third-party-advisory
- ADV-2010-2905 vdb-entry
- http://www.openoffice.org/security/cves/CVE-2010-0395.html