OpenOffice.org is prone to an overflow condition. The WW8ListManager::WW8ListManager function in oowriter fails to properly sanitize user-supplied input resulting in a heap-based buffer overflow. With a specially crafted .DOC file containing certain WW8 data which triggers an out-of-bounds write, a context-dependent attacker can potentially execute arbitrary code.

Upgrade to version 3.3 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

• CVE ID: 2010-3453 (see also: NVD)
• Secunia Advisory ID: 42999 43065 43105 43118 43388 43837 43913 44178 44202
• Bugtraq ID: 46031
• VUPEN Advisory: ADV-2011-0230 ADV-2011-0232
• Vendor Specific Solution URL: http://lists.debian.org/debian-security-announce/2011/msg00015.html
• Vendor Specific News/Changelog Entry: http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054137.html
  http://www.openoffice.org/security/cves/CVE-2010-3453_CVE-2010-3454.html
  https://bugzilla.redhat.com/show_bug.cgi?id=640950
  https://lists.ubuntu.com/archives/ubuntu-security-announce/2011-February/001240.html
  https://www.ibm.com/support/docview.wss?uid=swg21496070
• RedHat RHSA: http://rhn.redhat.com/errata/RHSA-2011-0182.html
  https://rhn.redhat.com/errata/RHSA-2011-0181.html
• Mail List Post: http://seclists.org/bugtraq/2011/Jan/172
• Other Advisory URL: http://www.cs.brown.edu/people/drosenbe/research.html
  http://www.debian.org/security/2011/dsa-2151
  http://www.oracle.com/technetwork/topics/security/cpuapr2011-301950.html#AppendixOOO
• Vendor Specific Advisory URL: https://hermes.opensuse.org/messages/7671999
  https://hermes.opensuse.org/messages/8086782
  https://hermes.opensuse.org/messages/8086783

• Dan Rosenberg - Virtual Security Research