Patch/Configuration Management, Vulnerability Management

Debian, Red Hat patch numerous OpenOffice flaws

Debian released a patch to fix multiple vulnerabilities in OpenOffice that open up the users' systems to compromise, Secunia reported on Wednesday.

One vulnerability was originally discovered by an anonymous researcher and reported to VeriSign’s iDefense Labs.

iDefense reported that research by Sean Larsson found additional flaws.

The security bugs include several within the software's libwpd library that can be exploited to cause a heap-based buffer overflow and allow the execution of arbitrary code. This flaw requires action by the user, such as by opening a "specially crafted WordPerfect document," according to a Secunia advisory.

Also on the list of bugs was a boundary error that could cause a stack-based buffer overflow through the opening of a similar document.

The third type of flaw is associated with shell meta characters that are not correctly escaped. This vulnerability can be exploited to inject and execute arbitrary shell commands through a malicious document or link.

Secunia reported these vulnerabilities as "highly critical," meaning that they can be exploited for remote code execution.

Red Hat also issued an update for OpenOffice that fixes the flaws. In an advisory released today, the Red Hat Security Response Team said the update has "important security impact."

Click here to email West Coast Bureau Chief Ericka Chickowski.

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.