John Heasman has reported some vulnerabilities in OpenOffice, which can be exploited by malicious people to compromise a user's system.

1) A truncation error within the handling of the META_ESCAPE record can be exploited to cause a heap-based buffer overflow via a specially crafted WMF/EMF file.

2) An integer overflow within the handling of EMR_POLYPOLYGON and EMR_POLYPOLYGON16 records can be exploited to cause a heap-based buffer overflow via a specially crafted WMF/EMF file.

Successful exploitation of the vulnerabilities allows execution of arbitrary code and requires that a user is tricked into opening a specially crafted WMF/EMF file or a specially crafted document.

The vulnerabilities are reported in OpenOffice prior to version 2.1.0. Other versions may also be affected.

Solution
Apply fixes or update to version 2.1.0.
Further details available to Secunia VIM customers

Provided and/or discovered by
John Heasman, NGSSoftware

Changelog
Further details available to Secunia VIM customers

Original Advisory
NGSSoftware:
http://www.ngssoftware.com/advisories/high-risk-vulnerabilities-in-the-openoffice-suite/

OpenOffice:
http://www.openoffice.org/issues/show_bug.cgi?id=70042

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers