CVE-2010-2935
En bref
- Source
- NVD
- EPSS
- EPSS 7.09 % · centile 94 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- redhat
- Statut NVD
- Modified
Rechercher sur…
Description
simpress.bin in the Impress module in OpenOffice.org (OOo) 2.x and 3.x before 3.3 does not properly handle integer values associated with dictionary property items, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PowerPoint document that triggers a heap-based buffer overflow, related to an "integer truncation error."
Faiblesses (CWE)
Références
- http://secunia.com/advisories/40775
- http://www.openoffice.org/servlets/ReadMsg?list=dev&msgNo=27690
- https://bugzilla.redhat.com/show_bug.cgi?id=622529
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:221
- http://www.vupen.com/english/advisories/2010/2003
- http://secunia.com/advisories/60799
- http://www.securitytracker.com/id?1024976
- http://www.gentoo.org/security/en/glsa/glsa-201408-19.xml
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12063
- http://www.vupen.com/english/advisories/2011/0150
- http://secunia.com/advisories/42927
- http://www.redhat.com/support/errata/RHSA-2010-0643.html
- http://www.vupen.com/english/advisories/2011/0230
- http://www.vupen.com/english/advisories/2010/2149
- http://www.openwall.com/lists/oss-security/2010/08/11/1
- http://www.vupen.com/english/advisories/2010/2228
- http://www.openoffice.org/security/cves/CVE-2010-2935_CVE-2010-2936.html
- http://secunia.com/advisories/41235
- http://ubuntu.com/usn/usn-1056-1
- http://www.vupen.com/english/advisories/2011/0279
- http://www.securitytracker.com/id?1024352
- http://secunia.com/advisories/43105
- http://securityevaluators.com/files/papers/CrashAnalysis.pdf
- http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00006.html
- http://www.debian.org/security/2010/dsa-2099
- http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html
- http://www.oracle.com/technetwork/topics/security/cpujan2011-194091.html
- http://secunia.com/advisories/41052
- http://www.vupen.com/english/advisories/2010/2905
- http://www.openwall.com/lists/oss-security/2010/08/11/4
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 2.0 | HIGH 9.3 | AV:N/AC:M/Au:N/C:C/I:C/A:C | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2010-2939
- GCVE · GCVE-0-2010-2935
Avis du CERT-FR
- CERTA-2011-AVI-243 — Vulnérabilités dans IBM Lotus Symphony · cert.ssi.gouv.fr
- CERTA-2011-AVI-039 — Multiples vulnérabilités dans OpenOffice.org · cert.ssi.gouv.fr
- CERTA-2011-AVI-022 — Multiples vulnérabilités dans les produits Oracle · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:openoffice:openoffice.org:3.2.1:*:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |