=====================================================================

                             CERT-Renater

                 Note d'Information No. 2021/VULN524
_____________________________________________________________________

DATE                : 08/10/2021

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Apache OpenOffice versions pprior
                                       to 4.1.11.

=====================================================================
http://mail-archives.apache.org/mod_mbox/www-announce/202110.mbox/%3cdad444e6-4a50-8779-c3ca-4d93b4539480@apache.org%3e
http://mail-archives.apache.org/mod_mbox/www-announce/202110.mbox/%3cacc768e9-28d5-d16a-ffbf-a9abcd3ebb9a@apache.org%3e
http://mail-archives.apache.org/mod_mbox/www-announce/202110.mbox/%3cc84b2bea-22f9-53aa-df5c-7fa605af0622@apache.org%3e
_____________________________________________________________________

CVE-2021-33035: Apache OpenOffice: Buffer overflow from a crafted DBF file

Severity: high

Description:

Apache OpenOffice opens dBase/DBF documents and shows the contents as
spreadsheets.  DBF are database files with data organized in fields.
When reading DBF data the size of certain fields is not checked: the
data is just copied into local variables. A carefully crafted document
could overflow the allocated space, leading to the execution of
arbitrary code by altering the contents of the program stack.

This issue affects Apache OpenOffice up to and including version 4.1.10

This issue is fixed in Apache OpenOffice 4.1.11


Credit:

Apache OpenOffice would like to thank Eugene Lim, Government Technology
Agency of Singapore for reporting this issue.

References:

https://github.com/apache/openoffice/commit/efddaef0151af3be16078cc4d88c6bae0f911e56#diff-ea66e734dd358922aba12ad4ba39c96bdc6cbde587d07dbc63d04daa0a30e90f

_____________________________________________________________________

CVE-2021-40439: Apache OpenOffice: Billion Laughs

Severity: medium

Description:

Apache OpenOffice has a dependency on expat software. Versions prior to
2.1.0 were subject to CVE-2013-0340 a "Billion Laughs" entity expansion
denial of service attack and exploit via crafted XML files. ODF files
consist of a set of XML files.

All versions of Apache OpenOffice up to 4.1.10 are subject to this issue.

expat in version 4.1.11 is patched.

_____________________________________________________________________

CVE-2021-28129: DEB packaging for Apache OpenOffice 4.1.8 installed with
a non-root userid and groupid

Severity: low

Description:

While working on Apache OpenOffice 4.1.8 a developer discovered that the
DEB package did not install using root, but instead used a userid and
groupid of 500. This both caused issues with desktop integration and
could allow a crafted attack on files owned by that user or group
if they exist.

Users who installed the Apache OpenOffice 4.1.8 DEB packaging should
upgrade to the latest version of Apache OpenOffice.


Credit:

Arrigo Marchiori


=========================================================
+ CERT-RENATER       |    tel : 01-53-94-20-44          +
+ 23/25 Rue Daviel   |    fax : 01-53-94-20-41          +
+ 75013 Paris        |    email:cert@support.renater.fr +
=========================================================