Description
simpress.bin in the Impress module in OpenOffice.org (OOo) 2.x and 3.x before 3.3 does not properly handle integer values associated with dictionary property items, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PowerPoint document that triggers a heap-based buffer overflow, related to an "integer truncation error."
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | openoffice.org | 1:2.4.1+dfsg-1+lenny8 | DSA-2099-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | openoffice.org +3 | 1.1.5-10.6.0.7.EL4.5 | RHSA-2010:0643 |
| RHEL 4 | openoffice.org2 +58 | 1:2.0.4-5.7.0.6.1.el4_8.6 | RHSA-2010:0643 |
| RHEL 3 | openoffice.org +2 | 1.1.2-48.2.0.EL3 | RHSA-2010:0643 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | libreoffice | 5.2.3.3-2.2 | openSUSE-SU-2024:10006-1 |
Advisories 3
- RHSA-2010:0643 Red Hat Security Advisory: openoffice.org security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2099-1 openoffice.org - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10006-1 libreoffice-5.2.3.3-2.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- 40775 third-party-advisory
- [dev] 20100806 Two exploitable OpenOffice.org bugs! mailing-list
- https://bugzilla.redhat.com/show_bug.cgi?id=622529
- MDVSA-2010:221 vendor-advisory
- ADV-2010-2003 vdb-entry
- 60799 third-party-advisory
- 1024976 vdb-entry
- GLSA-201408-19 vendor-advisory
- oval:org.mitre.oval:def:12063 vdb-entry signature
- ADV-2011-0150 vdb-entry
- 42927 third-party-advisory
- RHSA-2010:0643 vendor-advisory
- ADV-2011-0230 vdb-entry
- ADV-2010-2149 vdb-entry
- [oss-security] 20100811 CVE Request -- OpenOffice.org [two ids]: 1, integer truncation error 2, short integer overflow mailing-list
- ADV-2010-2228 vdb-entry
- http://www.openoffice.org/security/cves/CVE-2010-2935_CVE-2010-2936.html
- 41235 third-party-advisory
- USN-1056-1 vendor-advisory
- ADV-2011-0279 vdb-entry
- 1024352 vdb-entry
- 43105 third-party-advisory
- http://securityevaluators.com/files/papers/CrashAnalysis.pdf
- SUSE-SR:2010:024 vendor-advisory
- DSA-2099 vendor-advisory
- SUSE-SR:2010:019 vendor-advisory
- http://www.oracle.com/technetwork/topics/security/cpujan2011-194091.html
- 41052 third-party-advisory
- ADV-2010-2905 vdb-entry
- [oss-security] 20100811 Re: CVE Request -- OpenOffice.org [two ids]: 1, integer truncation error 2, short integer overflow mailing-list