CVE-2008-2238

Public PoC / Exploit

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Multiple integer overflows in OpenOffice.org (OOo) 2.x before 2.4.2 allow remote attackers to execute arbitrary code via crafted EMR records in an EMF file associated with a StarOffice/StarSuite document, which trigger a heap-based buffer overflow.

Weaknesses (CWE)

CWE-119

Affected Products (13)

openoffice · openoffice.orgvulnerable

References (20)

http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=750

http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html

http://neowiki.neooffice.org/index.php/NeoOffice_2.2.5_Patch_3_New_Features#Security_fixes

http://secunia.com/advisories/32419

Vendor Advisory

http://secunia.com/advisories/32461

Vendor Advisory

http://secunia.com/advisories/32463

http://secunia.com/advisories/32489

Vendor Advisory

http://secunia.com/advisories/32676

http://secunia.com/advisories/32856

http://secunia.com/advisories/32872

http://secunia.com/advisories/33140

http://security.gentoo.org/glsa/glsa-200812-13.xml

http://sunsolve.sun.com/search/document.do?assetkey=1-26-243226-1

http://www.debian.org/security/2008/dsa-1661

Patch

http://www.openoffice.org/security/cves/CVE-2008-2238.html

Patch

http://www.redhat.com/support/errata/RHSA-2008-0939.html

http://www.securityfocus.com/bid/31962

Patch

http://www.securitytracker.com/id?1021121

http://www.ubuntu.com/usn/usn-677-1

http://www.ubuntu.com/usn/usn-677-2