|
Sun StarOffice Office Suite RTF File and FreeType Font Parsing Vulnerabilities
|
|
Secunia Advisory:
|
SA25705
|
|
|
Release Date:
|
2007-06-18
|
|
Popularity:
|
5,571 views
|
|
|
Critical:
|
Highly critical
|
|
Impact:
|
DoS
System access
|
|
Where:
|
From remote
|
|
Solution Status:
|
Vendor Patch
|
|
| Software: | StarOffice / StarSuite 7.x
StarOffice / StarSuite 8.x
StarOffice 6.x
|
|
|
Subscribe:
|
Instant alerts on relevant vulnerabilities 
|
|
| CVE reference: | CVE-2007-2754
CVE-2007-0245
|
|
Description:
Sun has acknowledged two vulnerabilities in Sun StarOffice, which can be exploited by malicious people to compromise a user's system.
1) An error exists when parsing the "prdata" tag in RTF files where the first token is smaller that the second one. This can be exploited to cause a heap-based buffer overflow by e.g. tricking a user into opening a specially crafted RTF files.
2) A vulnerability is caused due to the use of a vulnerable copy of the FreeType library, which can be exploited to cause a heap based buffer overflow by e.g. tricking a user into opening a specially crafted document.
For more information:
SA25350
Note: Reportedly, vulnerability #2 does not affect the Windows versions.
Solution:
Apply patches. See vendor advisory for details.
Provided and/or discovered by:
1) John Heasman, NGSSoftware
2) Originally reported in the FreeType library by Victor Stinner (INL)
Original Advisory:
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102967-1
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102917-1
Other References:
SA25350:
http://secunia.com/advisories/25350/
|
|
|
Track this Secunia Advisory
|
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.
|
|
|
About this Secunia Advisory
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
