GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CERTA-2010-AVI-241

Vulnerability from certfr_avis - Published: - Updated:

Deux vulnérabilités d'OpenOffice.org permettent à un utilisateur malveillant respectivement d'exécuter du code arbitraire et de contourner la politique de sécurité.

Description

Une vulnérabilité dans la bibliothèque TLS/SSL permet à un utilisateur malveillant de contourner la politique de sécurité.

Une vulnérabilité dans l'environnement pour le langage Python peut conduire à l'exécution non souhaitée de scripts Python.

Solution

La version 3.2.1 d'OpenOffice.org remédie à ces problèmes.

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

OpenOffice.org 3.x.

Note : la branche OpenOffice.org 2.x n'est plus maintenue par le projet OpenOffice.org.

Impacted products
Vendor Product Description
References

Show details on source website
To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [],
  "affected_systems_content": "\u003cp\u003eOpenOffice.org 3.x.  \u003cP\u003eNote : la branche OpenOffice.org 2.x n\u0027est plus maintenue par  le projet OpenOffice.org.\u003c/P\u003e\u003c/p\u003e",
  "content": "## Description\n\nUne vuln\u00e9rabilit\u00e9 dans la biblioth\u00e8que TLS/SSL permet \u00e0 un utilisateur\nmalveillant de contourner la politique de s\u00e9curit\u00e9.\n\nUne vuln\u00e9rabilit\u00e9 dans l\u0027environnement pour le langage Python peut\nconduire \u00e0 l\u0027ex\u00e9cution non souhait\u00e9e de scripts Python.\n\n## Solution\n\nLa version 3.2.1 d\u0027OpenOffice.org rem\u00e9die \u00e0 ces probl\u00e8mes.\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2009-3555",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3555"
    },
    {
      "name": "CVE-2010-0395",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-0395"
    }
  ],
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 OpenOffice CVE-2010-0395 du 05 juin    2010 :",
      "url": "http://www.openoffice.org/security/cves/CVE-2010-0395.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 OpenOffice CVE-2009-3555 du 05 juin    2010 :",
      "url": "http://www.openoffice.org/security/cves/CVE-2009-3555.html"
    },
    {
      "title": "Document du CERTA CERTA-2009-AVI-482 du 19 mai 2010 :",
      "url": "http://www.certa.ssi.gouv.fr/site/CERTA-2009-AVI-482/index.html"
    }
  ],
  "reference": "CERTA-2010-AVI-241",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2010-06-07T00:00:00.000000"
    },
    {
      "description": "pr\u00e9cision sur les versions touch\u00e9es.",
      "revision_date": "2010-06-08T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "Deux vuln\u00e9rabilit\u00e9s d\u0027OpenOffice.org permettent \u00e0 un utilisateur\nmalveillant respectivement d\u0027ex\u00e9cuter du code arbitraire et de\ncontourner la politique de s\u00e9curit\u00e9.\n",
  "title": "Vuln\u00e9rabilit\u00e9s dans OpenOffice.org",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletins de s\u00e9curit\u00e9 OpenOffice CVE-2009-3555 et CVE-2010-0395 du 05 juin 2010",
      "url": null
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.