Some vulnerabilities and a security issue have been reported in OpenOffice, which potentially can be exploited by malicious people to compromise a user's system, and by malicious, local users to perform certain actions with escalated privileges.

1) An error in the processing of WMF files can be exploited to cause a heap-based buffer overflow via a specially crafted StarOffice/StarSuite document.

2) Multiple integer overflows when parsing certain EMR records of EMF files can be exploited to cause heap-based buffer overflows via a specially crafted StarOffice/StarSuite document.

Successful exploitation of the vulnerabilities may allow execution of arbitrary code.

3) The "senddoc" script uses temporary files in an insecure manner. This can be exploited via symlink attacks to overwrite arbitrary files with the privileges of the user running the affected script.

NOTE: The security issue only affects Unix versions of OpenOffice.

The vulnerabilities are reported in 2.x versions prior to 2.4.2.

Solution
Update to version 2.4.2.

Provided and/or discovered by
1) The vendor credits an anonymous researcher working with the SureRun Security Team
2) Sebastian Apelt and Code Audit Labs, reported via iDefense Labs
3) Reported by Dmitry E. Oboukhov in a Debian bug report.

Changelog
Further details available in Customer Area

Original Advisory
OpenOffice.org:
http://www.openoffice.org/security/cves/CVE-2008-2237.html
http://www.openoffice.org/security/cves/CVE-2008-2238.html

iDefense Labs:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=750

Debian:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=496361

Deep Links
Links available in Customer Area