Description
Multiple directory traversal vulnerabilities in OpenOffice.org (OOo) 2.x and 3.x before 3.3 allow remote attackers to overwrite arbitrary files via a .. (dot dot) in an entry in (1) an XSLT JAR filter description file, (2) an Extension (aka OXT) file, or unspecified other (3) JAR or (4) ZIP files.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | openoffice.org | 1:2.4.1+dfsg-1+lenny11 | DSA-2151-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | autocorr-af +135 | 1:3.2.1-19.6.el6_0.5 | RHSA-2011:0183 |
| RHEL 5 | openoffice.org +77 | 1:3.1.1-19.5.el5_5.6 | RHSA-2011:0182 |
| RHEL 4 | openoffice.org +3 | 1.1.5-10.7.el4_8.10 | RHSA-2011:0181 |
| RHEL 4 | openoffice.org2 +58 | 1:2.0.4-5.7.0.6.1.el4_8.8 | RHSA-2011:0181 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Productivity 5 | openoffice.org +77 | 1:3.1.1-19.5.el5_5.6 | RHSA-2011:0182 |
Advisories 4
- RHSA-2011:0183 Red Hat Security Advisory: openoffice.org security and bug fix update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2011:0182 Red Hat Security Advisory: openoffice.org security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2011:0181 Red Hat Security Advisory: openoffice.org and openoffice.org2 security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- DSA-2151-1 openoffice.org - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- 40775 third-party-advisory
- 70711 vdb-entry
- 46031 vdb-entry
- DSA-2151 vendor-advisory
- 60799 third-party-advisory
- http://www.oracle.com/technetwork/topics/security/cpuapr2011-301950.html
- GLSA-201408-19 vendor-advisory
- 43118 third-party-advisory
- 43065 third-party-advisory
- ADV-2011-0230 vdb-entry
- 1025002 vdb-entry
- ADV-2011-0232 vdb-entry
- RHSA-2011:0182 vendor-advisory
- USN-1056-1 vendor-advisory
- RHSA-2011:0181 vendor-advisory
- ADV-2011-0279 vdb-entry
- http://www.openoffice.org/security/cves/CVE-2010-3450.html
- 43105 third-party-advisory
- MDVSA-2011:027 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=602324
- 42999 third-party-advisory