Test ID:	1.3.6.1.4.1.25623.1.0.881294
Category:	CentOS Local Security Checks
Title:	CentOS Update for openoffice.org-base CESA-2011:0182 centos5 x86_64
Summary:	The remote host is missing an update for the 'openoffice.org-base'; package(s) announced via the referenced advisory.
Description:	Summary: The remote host is missing an update for the 'openoffice.org-base' package(s) announced via the referenced advisory. Vulnerability Insight: OpenOffice.org is an office productivity suite that includes desktop applications, such as a word processor, spreadsheet application, presentation manager, formula editor, and a drawing program. An array index error and an integer signedness error were found in the way OpenOffice.org parsed certain Rich Text Format (RTF) files. An attacker could use these flaws to create a specially-crafted RTF file that, when opened, would cause OpenOffice.org to crash or, possibly, execute arbitrary code with the privileges of the user running OpenOffice.org. (CVE-2010-3451, CVE-2010-3452) A heap-based buffer overflow flaw and an array index error were found in the way OpenOffice.org parsed certain Microsoft Office Word documents. An attacker could use these flaws to create a specially-crafted Microsoft Office Word document that, when opened, would cause OpenOffice.org to crash or, possibly, execute arbitrary code with the privileges of the user running OpenOffice.org. (CVE-2010-3453, CVE-2010-3454) A heap-based buffer overflow flaw was found in the way OpenOffice.org parsed certain Microsoft Office PowerPoint files. An attacker could use this flaw to create a specially-crafted Microsoft Office PowerPoint file that, when opened, would cause OpenOffice.org to crash or, possibly, execute arbitrary code with the privileges of the user running OpenOffice.org. (CVE-2010-4253) A heap-based buffer overflow flaw was found in the way OpenOffice.org parsed certain TARGA (Truevision TGA) files. An attacker could use this flaw to create a specially-crafted TARGA file. If a document containing this specially-crafted TARGA file was opened, or if a user tried to insert the file into an existing document, it would cause OpenOffice.org to crash or, possibly, execute arbitrary code with the privileges of the user running OpenOffice.org. (CVE-2010-4643) A directory traversal flaw was found in the way OpenOffice.org handled the installation of XSLT filter descriptions packaged in Java Archive (JAR) files, as well as the installation of OpenOffice.org Extension (.oxt) files. An attacker could use these flaws to create a specially-crafted XSLT filter description or extension file that, when opened, would cause the OpenOffice.org Extension Manager to modify files accessible to the user installing the JAR or extension file. (CVE-2010-3450) A flaw was found in the script that launches OpenOffice.org. In some situations, a '.' character could be included in the LD_LIBRARY_PATH variable, allowing a local attacker to execute ... Description truncated, please see the referenced URL(s) for more information. Affected Software/OS: openoffice.org-base on CentOS 5 Solution: Please install the updated packages. CVSS Score: 9.3 CVSS Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2010-3450 1025002 http://www.securitytracker.com/id?1025002 40775 http://secunia.com/advisories/40775 42999 http://secunia.com/advisories/42999 43065 http://secunia.com/advisories/43065 43105 http://secunia.com/advisories/43105 43118 http://secunia.com/advisories/43118 46031 http://www.securityfocus.com/bid/46031 60799 http://secunia.com/advisories/60799 70711 http://osvdb.org/70711 ADV-2011-0230 http://www.vupen.com/english/advisories/2011/0230 ADV-2011-0232 http://www.vupen.com/english/advisories/2011/0232 ADV-2011-0279 http://www.vupen.com/english/advisories/2011/0279 DSA-2151 http://www.debian.org/security/2011/dsa-2151 GLSA-201408-19 http://www.gentoo.org/security/en/glsa/glsa-201408-19.xml MDVSA-2011:027 http://www.mandriva.com/security/advisories?name=MDVSA-2011:027 RHSA-2011:0181 http://www.redhat.com/support/errata/RHSA-2011-0181.html RHSA-2011:0182 http://www.redhat.com/support/errata/RHSA-2011-0182.html USN-1056-1 http://ubuntu.com/usn/usn-1056-1 http://www.openoffice.org/security/cves/CVE-2010-3450.html http://www.oracle.com/technetwork/topics/security/cpuapr2011-301950.html https://bugzilla.redhat.com/show_bug.cgi?id=602324 Common Vulnerability Exposure (CVE) ID: CVE-2010-3451 70712 http://osvdb.org/70712 http://www.cs.brown.edu/people/drosenbe/research.html http://www.openoffice.org/security/cves/CVE-2010-3451_CVE-2010-3452.html http://www.vsecurity.com/resources/advisory/20110126-1 https://bugzilla.redhat.com/show_bug.cgi?id=641282 ooo-rtf-ce(65030) https://exchange.xforce.ibmcloud.com/vulnerabilities/65030 Common Vulnerability Exposure (CVE) ID: CVE-2010-3452 70713 http://osvdb.org/70713 https://bugzilla.redhat.com/show_bug.cgi?id=640241 ooo-oowriter-ce(65031) https://exchange.xforce.ibmcloud.com/vulnerabilities/65031 Common Vulnerability Exposure (CVE) ID: CVE-2010-3453 70714 http://osvdb.org/70714 http://www.openoffice.org/security/cves/CVE-2010-3453_CVE-2010-3454.html https://bugzilla.redhat.com/show_bug.cgi?id=640950 Common Vulnerability Exposure (CVE) ID: CVE-2010-3454 70715 http://osvdb.org/70715 https://bugzilla.redhat.com/show_bug.cgi?id=640954 Common Vulnerability Exposure (CVE) ID: CVE-2010-3689 1025004 http://www.securitytracker.com/id?1025004 70716 http://osvdb.org/70716 http://www.openoffice.org/security/cves/CVE-2010-3689.html https://bugzilla.redhat.com/show_bug.cgi?id=641224 Common Vulnerability Exposure (CVE) ID: CVE-2010-4253 70717 http://osvdb.org/70717 http://www.openoffice.org/security/cves/CVE-2010-4253.html https://bugzilla.redhat.com/show_bug.cgi?id=658259 Common Vulnerability Exposure (CVE) ID: CVE-2010-4643 70718 http://osvdb.org/70718 http://www.openoffice.org/security/cves/CVE-2010-4643.html https://bugzilla.redhat.com/show_bug.cgi?id=667588 ooo-tga-bo(65441) https://exchange.xforce.ibmcloud.com/vulnerabilities/65441
Copyright	Copyright (C) 2012 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.