Description
Apache OpenOffice opens dBase/DBF documents and shows the contents as spreadsheets. DBF are database files with data organized in fields. When reading DBF data the size of certain fields is not checked: the data is just copied into local variables. A carefully crafted document could overflow the allocated space, leading to the execution of arbitrary code by altering the contents of the program stack. This issue affects Apache OpenOffice up to and including version 4.1.10
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache OpenOffice | Apache OpenOffice – ≤ 4.1.10, OpenOffice.org – ≤ 3.4 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libreoffice | 1:4.3.1-1 | — |
| Debian 13 | libreoffice | 1:4.3.1-1 | — |
| Debian 12 | libreoffice | 1:4.3.1-1 | — |
References
- https://github.com/apache/openoffice/commit/efddaef0151af3be16078cc4d88c6bae0f911e56#diff-ea66e734dd358922aba12ad4ba39c96bdc6cbde587d07dbc63d04daa0a30e90f
- [announce] 20211007 CVE-2021-33035: Apache OpenOffice: Buffer overflow from a crafted DBF file mailing-list
- [openoffice-users] 20211007 CVE-2021-33035: Apache OpenOffice: Buffer overflow from a crafted DBF file mailing-list
- [oss-security] 20211007 CVE-2021-33035: Apache OpenOffice: Buffer overflow from a crafted DBF file mailing-list