CVE-2021-28129

· HIGHModified

← All CVEs

CVSS v3.1

7.8

EPSS

0.53%

Published

Oct 7, 2021

Modified

Nov 21, 2024

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

While working on Apache OpenOffice 4.1.8 a developer discovered that the DEB package did not install using root, but instead used a userid and groupid of 500. This both caused issues with desktop integration and could allow a crafted attack on files owned by that user or group if they exist. Users who installed the Apache OpenOffice 4.1.8 DEB packaging should upgrade to the latest version of Apache OpenOffice.

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-284

Affected Products (1)

apache · openofficevulnerable

References (8)

http://www.openwall.com/lists/oss-security/2021/10/07/5

Mailing ListThird Party Advisory

https://lists.apache.org/thread.html/r9e72234dd662280fa1a3cca6164d3470a1dbc0d8e53e48ba27f787ce%40%3Cannounce.apache.org%3E

https://lists.apache.org/thread.html/rc9090ab48b4699494b63b35cd6d7414c52d665ecae12add3cdc56c9b%40%3Cusers.openoffice.apache.org%3E

Mailing ListVendor Advisory

https://lists.apache.org/thread.html/rc9090ab48b4699494b63b35cd6d7414c52d665ecae12add3cdc56c9b%40%3Cusers.openoffice.apache.org%3E

Mailing ListVendor Advisory

http://www.openwall.com/lists/oss-security/2021/10/07/5

KEV Catalog EPSS Scores Vendors All CVEs