Description
Multiple heap-based buffer overflows in the XML manifest encryption tag parsing functionality in OpenOffice.org and LibreOffice before 3.5.5 allow remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted Open Document Text (.odt) file with (1) a child tag within an incorrect parent tag, (2) duplicate tags, or (3) a Base64 ChecksumAttribute whose length is not evenly divisible by four.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libreoffice | 1:3.5.4-7 | — |
| Debian 13 | libreoffice | 1:3.5.4-7 | — |
| Debian 12 | libreoffice | 1:3.5.4-7 | — |
| Debian 6.0 | openoffice.org | 1:3.2.1-11+squeeze7 | DSA-2520-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | autocorr-af +123 | 1:3.4.5.2-16.1.el6_3 | RHSA-2012:1135 |
| RHEL 5 | openoffice.org +77 | 1:3.1.1-19.10.el5_8.4 | RHSA-2012:1136 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Productivity 5 | openoffice.org +77 | 1:3.1.1-19.10.el5_8.4 | RHSA-2012:1136 |
Advisories 3
- RHSA-2012:1135 Red Hat Security Advisory: libreoffice security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2012:1136 Red Hat Security Advisory: openoffice.org security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2520-1 openoffice.org - Multiple heap-based buffer overflows Debian Security (DSA / DLA) · Mar 9, 2026
References
- 60799 third-party-advisory
- GLSA-201408-19 vendor-advisory
- GLSA-201209-05 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=826077
- DSA-2520 vendor-advisory
- USN-1536-1 vendor-advisory
- RHSA-2012:1135 vendor-advisory
- http://www.pre-cert.de/advisories/PRE-SA-2012-05.txt
- 54769 vdb-entry
- 50692 third-party-advisory
- 1027332 vdb-entry
- 1027331 vdb-entry
- 50142 third-party-advisory
- USN-1537-1 vendor-advisory
- http://www.libreoffice.org/about-us/security/advisories/cve-2012-2665/
- 50146 third-party-advisory