Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 78

Export CSV
CVE-2012-0037

raptor: XML External Entity (XXE) attack via RDF files

Redland Raptor (aka libraptor) before 2.0.7, as used by OpenOffice 3.3 and 3.4 Beta, LibreOffice before 3.4.6 and 3.5.x before 3.5.1, and other products, allows user-assisted remote attackers to read arbitrary files via a crafted XML external entity (XXE) declaration and reference in an RDF document.

CVSS 3.1 · 6.5 Medium EPSS 13.5% KEV · Not listed
Vendors
Apache Debian Fedoraproject and 3 more
Products
Openoffice Debian Linux Fedora and 11 more
CVE-2010-4643

OpenOffice.org: heap based buffer overflow when parsing TGA files

Heap-based buffer overflow in Impress in OpenOffice.org (OOo) 2.x and 3.x before 3.3 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted Truevision TGA (TARGA) file in an ODF or Microsoft Office document.

CVSS 2.0 · 9.3 Critical EPSS 10.1% KEV · Not listed
Vendors
Apache Redhat
Products
Openoffice Enterprise Linux
CVE-2010-4494

libxml2: double-free in XPath processing code

Double free vulnerability in libxml2 2.7.8 and other versions, as used in Google Chrome before 8.0.552.215 and other products, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to XPath handling.

CVSS 2.0 · 7.5 High EPSS 5.9% KEV · Not listed
Vendors
Apache Apple Debian and 7 more
Products
Openoffice Iphone Os Itunes and 15 more
CVE-2010-4253

OpenOffice.org: heap based buffer overflow in PPT import

Heap-based buffer overflow in Impress in OpenOffice.org (OOo) 2.x and 3.x before 3.3 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PNG file in an ODF or Microsoft Office document, as demonstrated by a PowerPoint (aka PPT) document.

CVSS 2.0 · 9.3 Critical EPSS 10.1% KEV · Not listed
Vendors
Apache Canonical Debian and 1 more
Products
Openoffice Ubuntu Linux Debian Linux and 1 more
CVE-2010-4008

libxml2: Crash (stack frame overflow or NULL pointer dereference) by traversal of XPath axis

libxml2 before 2.7.8, as used in Google Chrome before 7.0.517.44, Apple Safari 5.0.2 and earlier, and other products, reads from invalid memory locations during processing of malformed XPath expressions, which allows context-dependent attackers to cause a denial of service (application crash) via a crafted XML document.

CVSS 2.0 · 4.3 Medium EPSS 2.7% KEV · Not listed
Vendors
Apache Apple Canonical and 6 more
Products
Openoffice Iphone Os Itunes and 13 more
CVE-2010-3689

OpenOffice.org: soffice insecure LD_LIBRARY_PATH setting

soffice in OpenOffice.org (OOo) 3.x before 3.3 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.

CVSS 2.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Apache Canonical Debian and 1 more
Products
Openoffice Ubuntu Linux Debian Linux and 1 more
CVE-2010-3454

OpenOffice.org: Array index error by scanning document typography information of certain *.doc files

Multiple off-by-one errors in the WW8DopTypography::ReadFromMem function in oowriter in OpenOffice.org (OOo) 2.x and 3.x before 3.3 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted typography information in a Microsoft Word .DOC file that triggers an out-of-bounds write.

CVSS 2.0 · 9.3 Critical EPSS 10.3% KEV · Not listed
Vendors
Apache Canonical Debian and 1 more
Products
Openoffice Ubuntu Linux Debian Linux and 1 more
CVE-2010-3453

OpenOffice.org: Heap-based buffer overflow by processing *.doc files with WW8 list styles with specially-crafted count of list levels

The WW8ListManager::WW8ListManager function in oowriter in OpenOffice.org (OOo) 2.x and 3.x before 3.3 does not properly handle an unspecified number of list levels in user-defined list styles in WW8 data in a Microsoft Word document, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted .DOC file that triggers an out-of-bounds write.

CVSS 2.0 · 9.3 Critical EPSS 9.7% KEV · Not listed
Vendors
Apache Canonical Debian and 1 more
Products
Openoffice Ubuntu Linux Debian Linux and 1 more
CVE-2010-3452

OpenOffice.org: Integer signedness error (crash) by processing certain RTF tags

Use-after-free vulnerability in oowriter in OpenOffice.org (OOo) 2.x and 3.x before 3.3 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted tags in an RTF document.

CVSS 2.0 · 9.3 Critical EPSS 10.3% KEV · Not listed
Vendors
Apache Canonical Debian and 1 more
Products
Openoffice Ubuntu Linux Debian Linux and 1 more
CVE-2010-3451

OpenOffice.org: Array index error by insecure parsing of broken rtf tables

Use-after-free vulnerability in oowriter in OpenOffice.org (OOo) 2.x and 3.x before 3.3 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via malformed tables in an RTF document.

CVSS 2.0 · 9.3 Critical EPSS 10.3% KEV · Not listed
Vendors
Apache Canonical Debian and 1 more
Products
Openoffice Ubuntu Linux Debian Linux and 1 more
CVE-2010-3450

OpenOffice.org: directory traversal flaws in handling of XSLT jar filter descriptions and OXT extension files

Multiple directory traversal vulnerabilities in OpenOffice.org (OOo) 2.x and 3.x before 3.3 allow remote attackers to overwrite arbitrary files via a .. (dot dot) in an entry in (1) an XSLT JAR filter description file, (2) an Extension (aka OXT) file, or unspecified other (3) JAR or (4) ZIP files.

CVSS 2.0 · 9.3 Critical EPSS 10.7% KEV · Not listed
Vendors
Apache Canonical Debian and 1 more
Products
Openoffice Ubuntu Linux Debian Linux and 1 more
CVE-2010-0395

openoffice.org Execution of Python code when browsing macros

OpenOffice.org 2.x and 3.0 before 3.2.1 allows user-assisted remote attackers to bypass Python macro security restrictions and execute arbitrary Python code via a crafted OpenDocument Text (ODT) file that triggers code execution when the macro directory structure is previewed.

CVSS 2.0 · 9.3 Critical EPSS 10.5% KEV · Not listed
Vendors
Apache Canonical Debian and 4 more
Products
Openoffice Ubuntu Linux Debian Linux and 4 more
CVE-2010-0136

openoffice.org: unenforced VBA macro security settings may lead to arbitrary macro execution

OpenOffice.org (OOo) 2.0.4, 2.4.1, and 3.1.1 does not properly enforce Visual Basic for Applications (VBA) macro security settings, which allows remote attackers to run arbitrary macros via a crafted document.

CVSS 2.0 · 9.3 Critical EPSS 8.1% KEV · Not listed
Vendors
Apache Canonical Debian
Products
Openoffice Ubuntu Linux Debian Linux
CVE-2009-3302

OpenOffice.org Word sprmTSetBrc Memory Corruption

filter/ww8/ww8par2.cxx in OpenOffice.org (OOo) before 3.2 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted sprmTSetBrc table property modifier in a Word document, related to a "boundary error flaw."

CVSS 2.0 · 9.3 Critical EPSS 11.7% KEV · Not listed
Vendors
Apache Canonical Debian and 1 more
Products
Openoffice Ubuntu Linux Debian Linux and 1 more
CVE-2009-3301

OpenOffice.org Word sprmTDefTable Memory Corruption

Integer underflow in filter/ww8/ww8par2.cxx in OpenOffice.org (OOo) before 3.2 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted sprmTDefTable table property modifier in a Word document.

CVSS 2.0 · 9.3 Critical EPSS 12.0% KEV · Not listed
Vendors
Apache Canonical Debian and 1 more
Products
Openoffice Ubuntu Linux Debian Linux and 1 more
CVE-2009-2950

openoffice.org: GIF file parsing heap overflow

Heap-based buffer overflow in the GIFLZWDecompressor::GIFLZWDecompressor function in filter.vcl/lgif/decode.cxx in OpenOffice.org (OOo) before 3.2 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted GIF file, related to LZW decompression.

CVSS 2.0 · 9.3 Critical EPSS 13.5% KEV · Not listed
Vendors
Apache Canonical Debian and 1 more
Products
Openoffice Ubuntu Linux Debian Linux and 1 more
CVE-2013-4156

libreoffice: NULL pointer dereference when parsing certain DOCM documents

Apache OpenOffice.org (OOo) before 4.0 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted element in an OOXML document file.

CVSS 2.0 · 6.8 Medium EPSS 3.9% KEV · Not listed
Vendors
Apache
Products
Openoffice
CVE-2012-2665

libreoffice: Multiple heap-based buffer overflows in the XML manifest encryption handling code

Multiple heap-based buffer overflows in the XML manifest encryption tag parsing functionality in OpenOffice.org and LibreOffice before 3.5.5 allow remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted Open Document Text (.odt) file with (1) a child tag within an incorrect parent tag, (2) duplicate tags, or (3) a Base64 ChecksumAttribute whose length is not evenly divisible by four.

CVSS 2.0 · 7.5 High EPSS 7.0% KEV · Not listed
Vendors
Apache Canonical Debian and 2 more
Products
Openoffice Ubuntu Linux Debian Linux and 8 more
CVE-2012-2334

libreoffice: Integer overflow leading to buffer overflow by processing invalid Escher graphics records length in the Powerpoint documents

Integer overflow in filter/source/msfilter/msdffimp.cxx in OpenOffice.org (OOo) 3.3, 3.4 Beta, and possibly earlier, and LibreOffice before 3.5.3, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the length of an Escher graphics record in a PowerPoint (.ppt) document, which triggers a buffer overflow.

CVSS 2.0 · 6.8 Medium EPSS 13.4% KEV · Not listed
Vendors
Apache Libreoffice Redhat
Products
Openoffice.org Libreoffice Enterprise Linux
CVE-2012-2149

libwpd: Memory overwrite flaw by processing certain WordPerfect (WPD) documents

The WPXContentListener::_closeTableRow function in WPXContentListener.cpp in libwpd 0.8.8, as used by OpenOffice.org (OOo) before 3.4, allows remote attackers to execute arbitrary code via a crafted Wordperfect .WPD document that causes a negative array index to be used. NOTE: some sources report this issue as an integer overflow.

CVSS 2.0 · 7.5 High EPSS 13.7% KEV · Not listed
Vendors
Apache Libwpd Redhat
Products
Openoffice.org Libwpd Enterprise Linux and 2 more