Bug 527540 (CVE-2009-2949)

Summary: CVE-2009-2949 openoffice.org: integer overflow in XPM processing
Product: [Other] Security Response Reporter: Vincent Danen <vdanen>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: caolanm, dtardon, jlieskov, kreilly, mjc, security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
URL: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-2949
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2010-03-29 10:05:21 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 529747, 529748, 529749, 529750, 529751, 529752, 529753    
Bug Blocks:    
Attachments:
Description Flags
same combined patch as in CVE-2009-2950 none

Description Vincent Danen 2009-10-06 20:50:39 UTC 
It was reported that it was possible to trigger an integer overflow that leads to a heap overflow due to the way OpenOffice.org parsed XPM files.  This could allow an attacker to execute abitrary code with the permissions of the user running OpenOffice.org, provided they could coerce them to open a malicious document containing a specially crafted XPM file.  This is not restricted to XPM files alone, but to embedded XPM files in OpenOffice.org documents.

The vulnerability can be found in XPMReader::ReadXPM (source/filter.vcl/ixpm/svt_xpmread.cxx)

This vulnerability has been assigned CVE-2009-2949.
Comment 3 Caolan McNamara 2009-10-19 19:09:29 UTC 
Created attachment 365265 [details]
same combined patch as in CVE-2009-2950

yeah, patch at CVE-2009-2950 (copied here) is the combined patch for both CVEs
Comment 7 Jan Lieskovsky 2010-02-12 13:37:53 UTC 
Public now via:
  http://www.openoffice.org/security/bulletin.html
Comment 8 Tomas Hoger 2010-02-12 13:57:50 UTC 
http://www.openoffice.org/security/cves/CVE-2009-2949.html
Comment 9 errata-xmlrpc 2010-02-12 16:22:40 UTC 
This issue has been addressed in following products:

  Red Hat Enterprise Linux 3
  Red Hat Enterprise Linux 4
  Red Hat Enterprise Linux 5

Via RHSA-2010:0101 https://rhn.redhat.com/errata/RHSA-2010-0101.html
Comment 10 Fedora Update System 2010-02-13 11:56:30 UTC 
openoffice.org-3.1.1-19.12.fc11 has been submitted as an update for Fedora 11.
http://admin.fedoraproject.org/updates/openoffice.org-3.1.1-19.12.fc11
Comment 11 Fedora Update System 2010-02-13 11:59:33 UTC 
openoffice.org-3.1.1-19.26.fc12 has been submitted as an update for Fedora 12.
http://admin.fedoraproject.org/updates/openoffice.org-3.1.1-19.26.fc12
Comment 12 Fedora Update System 2010-02-16 13:02:01 UTC 
openoffice.org-3.1.1-19.26.fc12 has been pushed to the Fedora 12 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 13 Fedora Update System 2010-02-16 13:23:48 UTC 
openoffice.org-3.1.1-19.12.fc11 has been pushed to the Fedora 11 stable repository.  If problems still persist, please make note of it in this bug report.