OpenOffice.org is prone to an overflow condition. The 'WW8DopTypography::ReadFromMem' function in oowriter fails to properly sanitize user-supplied input resulting in a heap-based buffer overflow. With specially crafted typography information in a crafted .DOC file which triggers an out-of-bound write, a context-dependent attacker can potentially execute arbitrary code.

Upgrade to version 3.3 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

• CVE ID: 2010-3454 (see also: NVD)
• Secunia Advisory ID: 42999 43065 43105 43118 43388 43837 43913 44178 44202
• Bugtraq ID: 46031
• VUPEN Advisory: ADV-2011-0230 ADV-2011-0232
• Vendor Specific Solution URL: http://lists.debian.org/debian-security-announce/2011/msg00015.html
• Vendor Specific News/Changelog Entry: http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054137.html
  http://www.openoffice.org/security/cves/CVE-2010-3453_CVE-2010-3454.html
  https://bugzilla.redhat.com/show_bug.cgi?id=640954
  https://lists.ubuntu.com/archives/ubuntu-security-announce/2011-February/001240.html
  https://www.ibm.com/support/docview.wss?uid=swg21496070
• RedHat RHSA: http://rhn.redhat.com/errata/RHSA-2011-0182.html
  https://rhn.redhat.com/errata/RHSA-2011-0181.html
• Mail List Post: http://seclists.org/bugtraq/2011/Jan/172
• Other Advisory URL: http://www.cs.brown.edu/people/drosenbe/research.html
  http://www.debian.org/security/2011/dsa-2151
  http://www.oracle.com/technetwork/topics/security/cpuapr2011-301950.html#AppendixOOO
• Vendor Specific Advisory URL: https://hermes.opensuse.org/messages/7671999
  https://hermes.opensuse.org/messages/8086782
  https://hermes.opensuse.org/messages/8086783

• Dan Rosenberg - Virtual Security Research