Secunia

Sun has acknowledged two vulnerabilities in Sun StarOffice, which can be exploited by malicious people to compromise a user's system.

1) An error exists when parsing the "prdata" tag in RTF files where the first token is smaller that the second one. This can be exploited to cause a heap-based buffer overflow by e.g. tricking a user into opening a specially crafted RTF files.

2) A vulnerability is caused due to the use of a vulnerable copy of the FreeType library, which can be exploited to cause a heap based buffer overflow by e.g. tricking a user into opening a specially crafted document.

For more information:
SA25350

Note: Reportedly, vulnerability #2 does not affect the Windows versions.

Solution
Apply patches. See vendor advisory for details.

Provided and/or discovered by
1) John Heasman, NGSSoftware
2) Originally reported in the FreeType library by Victor Stinner (INL)

Original Advisory
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102967-1
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102917-1

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area