It was reported that it was possible to trigger an integer overflow that leads to a heap overflow due to the way OpenOffice.org parsed XPM files. This could allow an attacker to execute abitrary code with the permissions of the user running OpenOffice.org, provided they could coerce them to open a malicious document containing a specially crafted XPM file. This is not restricted to XPM files alone, but to embedded XPM files in OpenOffice.org documents.
The vulnerability can be found in XPMReader::ReadXPM (source/filter.vcl/ixpm/svt_xpmread.cxx)
This vulnerability has been assigned CVE-2009-2949.
Created attachment 365265 [details]
same combined patch as in CVE-2009-2950
yeah, patch at CVE-2009-2950 (copied here) is the combined patch for both CVEs
Public now via:
This issue has been addressed in following products:
Red Hat Enterprise Linux 3
Red Hat Enterprise Linux 4
Red Hat Enterprise Linux 5
Via RHSA-2010:0101 https://rhn.redhat.com/errata/RHSA-2010-0101.html
openoffice.org-3.1.1-19.12.fc11 has been submitted as an update for Fedora 11.
openoffice.org-3.1.1-19.26.fc12 has been submitted as an update for Fedora 12.
openoffice.org-3.1.1-19.26.fc12 has been pushed to the Fedora 12 stable repository. If problems still persist, please make note of it in this bug report.
openoffice.org-3.1.1-19.12.fc11 has been pushed to the Fedora 11 stable repository. If problems still persist, please make note of it in this bug report.