CERTA-2006-AVI-277
Vulnerability from certfr_avis
None
Description
Une vulnérabilité a été identifiée dans les logiciels de bureautique StarOffice et OpenOffice.org. Un utilisateur malveillant peut créer un document au format XML spécialement conçu. Si celui-ci est ouvert par des applications comme Calc, Draw, Impress, Math ou Writer, il peut créer un débordement de pile et exécuter des commandes arbitraires sur le système vulnérable.
Solution
Se référer au bulletin de sécurité des éditeurs pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| OpenOffice | N/A | StarOffice version 8 Office Suite ; | ||
| OpenOffice | N/A | StarOffice version 7 ; | ||
| OpenOffice | N/A | StarSuite version 7 ; | ||
| OpenOffice | N/A | StarOffice version 6 Office Suite ; | ||
| OpenOffice | N/A | les versions d'OpenOffice.org 2.0.x antérieures à 2.0.3 ; | ||
| OpenOffice | N/A | StarSuite version 8. | ||
| OpenOffice | N/A | OpenOffice.org version 1.1.5 ; |
References
| Title | Publication Time | Tags | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "StarOffice version 8 Office Suite ;",
"product": {
"name": "N/A",
"vendor": {
"name": "OpenOffice",
"scada": false
}
}
},
{
"description": "StarOffice version 7 ;",
"product": {
"name": "N/A",
"vendor": {
"name": "OpenOffice",
"scada": false
}
}
},
{
"description": "StarSuite version 7 ;",
"product": {
"name": "N/A",
"vendor": {
"name": "OpenOffice",
"scada": false
}
}
},
{
"description": "StarOffice version 6 Office Suite ;",
"product": {
"name": "N/A",
"vendor": {
"name": "OpenOffice",
"scada": false
}
}
},
{
"description": "les versions d\u0027OpenOffice.org 2.0.x ant\u00e9rieures \u00e0 2.0.3 ;",
"product": {
"name": "N/A",
"vendor": {
"name": "OpenOffice",
"scada": false
}
}
},
{
"description": "StarSuite version 8.",
"product": {
"name": "N/A",
"vendor": {
"name": "OpenOffice",
"scada": false
}
}
},
{
"description": "OpenOffice.org version 1.1.5 ;",
"product": {
"name": "N/A",
"vendor": {
"name": "OpenOffice",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Description\n\nUne vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 identifi\u00e9e dans les logiciels de bureautique\nStarOffice et OpenOffice.org. Un utilisateur malveillant peut cr\u00e9er un\ndocument au format XML sp\u00e9cialement con\u00e7u. Si celui-ci est ouvert par\ndes applications comme Calc, Draw, Impress, Math ou Writer, il peut\ncr\u00e9er un d\u00e9bordement de pile et ex\u00e9cuter des commandes arbitraires sur\nle syst\u00e8me vuln\u00e9rable.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 des \u00e9diteurs pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2006-3117",
"url": "https://www.cve.org/CVERecord?id=CVE-2006-3117"
}
],
"initial_release_date": "2006-07-10T00:00:00",
"last_revision_date": "2006-07-10T00:00:00",
"links": [
{
"title": "Avis du CERTA CERTA-2006-AVI-271-001 associ\u00e9 :",
"url": "http://www.certa.ssi.gouv.fr/site/CERTA-2006-AVI-271/"
},
{
"title": "Mise \u00e0 jour d\u0027OpenOffice.org du 07 juillet 2006 :",
"url": "http://download.openoffice.org/"
}
],
"reference": "CERTA-2006-AVI-277",
"revisions": [
{
"description": "version initiale.",
"revision_date": "2006-07-10T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
}
],
"summary": null,
"title": "Vuln\u00e9rabilit\u00e9 d\u0027OpenOffice.org et StarOffice",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Sun Microsystems",
"url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-102501-1"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…