Description
Integer overflow in filter/source/msfilter/msdffimp.cxx in OpenOffice.org (OOo) 3.3, 3.4 Beta, and possibly earlier, and LibreOffice before 3.5.3, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the length of an Escher graphics record in a PowerPoint (.ppt) document, which triggers a buffer overflow.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libreoffice | 1:3.5.2~rc2-1 | — |
| Debian 13 | libreoffice | 1:3.5.2~rc2-1 | — |
| Debian 12 | libreoffice | 1:3.5.2~rc2-1 | — |
| Debian 6.0 | openoffice.org | 1:3.2.1-11+squeeze6 | DSA-2487-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | autocorr-af +135 | 1:3.2.1-19.6.el6_2.7 | RHSA-2012:0705 |
| RHEL 5 | openoffice.org +77 | 1:3.1.1-19.10.el5_8.3 | RHSA-2012:0705 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Productivity 5 | openoffice.org +77 | 1:3.1.1-19.10.el5_8.3 | RHSA-2012:0705 |
Advisories 2
- RHSA-2012:0705 Red Hat Security Advisory: openoffice.org security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- DSA-2487-1 openoffice.org - buffer overflow Debian Security (DSA / DLA) · Mar 9, 2026
References
- 60799 third-party-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=821803
- GLSA-201408-19 vendor-advisory
- MDVSA-2012:090 vendor-advisory
- 20120516 CVE-2012-2334 Vulnerabilities related to malformed Powerpoint files in OpenOffice.org 3.3.0 mailing-list
- http://cgit.freedesktop.org/libreoffice/core/commit/?id=512401decb286ba0fc3031939b8f7de8649c502e
- FEDORA-2012-8114 vendor-advisory
- 53570 vdb-entry
- [oss-security] 20120528 Kind request to update upstream CVE-2012-2334 advisories they to reflect arbitrary code execution possibility too and OSS list notification mailing-list
- 1027070 vdb-entry
- http://www.libreoffice.org/advisories/cve-2012-2334/
- DSA-2487 vendor-advisory
- 46992 third-party-advisory
- http://cgit.freedesktop.org/libreoffice/core/commit/?id=28a6558f9d3ca2dda3191f8b5b3f2378ee2533da
- 47244 third-party-advisory
- openoffice-powerpoint-dos(75695) vdb-entry
- 49392 third-party-advisory
- 49373 third-party-advisory
- RHSA-2012:0705 vendor-advisory
- MDVSA-2012:091 vendor-advisory
- http://www.openoffice.org/security/cves/CVE-2012-2334.html
- 82517 vdb-entry