The StgCompObjStream::Load function in OpenOffice.org OpenOffice 1.1.4 and earlier allocates memory based on 16 bit length values, but process memory using 32 bit values, which allows remote attackers to cause a denial of service and possibly execute arbitrary code via a DOC document with certain length values, which leads to a heap-based buffer overflow.
CVSS Details
- CVSS 3.1 Base Score: 5.6
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Freebsd | — | Upgrade el-openofficeUpgrade zh-openoffice-TWUpgrade zh-openofficeUpgrade tr-openofficeUpgrade ca-openofficeUpgrade gr-openofficeUpgrade ar-openofficeUpgrade cs-openofficeUpgrade sl-openoffice-SLUpgrade sk-openofficeUpgrade it-openofficeUpgrade zh-openoffice-CNUpgrade ja-openofficeUpgrade et-openofficeUpgrade nl-openofficeUpgrade kr-openofficeUpgrade hu-openofficeUpgrade de-openofficeUpgrade ko-openofficeUpgrade es-openofficeUpgrade sl-openoffice-SIUpgrade se-openofficeUpgrade openofficeUpgrade zh_TW-openofficeUpgrade pt_BR-openofficeUpgrade jp-openofficeUpgrade fi-openofficeUpgrade fr-openofficeUpgrade pt-openofficeUpgrade dk-openofficeUpgrade ru-openofficeUpgrade pl-openoffice | Dec 10, 2025 | Apr 13, 2005 |
| Gentoo Linux | — | Upgrade app-office/openoffice.Upgrade app-office/openoffice-ximian.Upgrade app-office/openoffice-bin. | Oct 30, 2017 | May 2, 2005 |
| Ubuntu | — | Upgrade openoffice.org-l10n-xh | Nov 8, 2024 | May 2, 2005 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub