CVE-2013-4156: OpenOffice DOCM Memory Corruption Vulnerability

[Herbert Duerr <hd...@apache.org>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

CVE-2013-4156
OpenOffice DOCM Memory Corruption Vulnerability

Severity: Important
Vendor: The Apache Software Foundation

Versions Affected:
     Apache OpenOffice 3.4.0 and 3.4.1, on all platforms.
     Predecessor versions of OpenOffice.org may be also affected.

Description:

     The vulnerability is caused by mishandling of unknown XML elements
when parsing a OOXML document file. Specially crafted documents can be
used for memory-corruption attacks. Further exploits are possible but
have not been verified.

Mitigation

     Apache OpenOffice 3.4.0 and 3.4.1 users are advised to upgrade to
Apache OpenOffice 4.0. Users who are unable to upgrade immediately
should be cautious when opening untrusted documents.

Credits

     The Apache OpenOffice Security Team credits Jeremy Brown of
Microsoft Vulnerability Research as the discoverer of this flaw.

Herbert Dürr
Member of the Apache OpenOffice Security Team
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iQIcBAEBAgAGBQJR8g+LAAoJEDfnuKc+PLjJPmkP/j3BnqefvmPbTicx8cZR+Q+I
Y0EqD/2Kvu0qQw6v7S27CnHVpErh9tvEfDViZpXz8hyds3LgVCxOQjFp+XSqvDTW
Ut4Ug1tx7N8+RcpTW7qM0/wRRWdjZIdh8sTrtkB93bqbJguLiYk3KWqK2cxW11q6
1fQitnAegZNRVZnSU0rGGVfnc26ulvS0gljpNqhvDit9jOXw5MC+aN05XmCrx/qK
NrGUUPJeiyi/5g0xxx4ig/N0/EvO1iZmQAGEE7O24tsoP1hqvuySI0U1kLIhI//x
ZdeK4JukZm2OQq0ACXJYhrU0mhfCfdaRW0U4NWiTpBbwfsn0uAMPBhXSO9O+YPQj
sWUzLixEg+4EtTQss9oGW+CBaZz+HfErIIUj2rxT01SDlbcfa4ME5giFGC0UO9Ai
1N+GHd8IyWegwUBWV3FSZ9fCbDjaQUCv8cYN3zMo/xl/AsA9LKEsJ0l51B1WnHnY
nwoXunUdgUL06blCZ4rwTzoFqSSPrCBDb/ff/PREGvJU4LOFTp6IrxgDH3ODSAE4
jOMuFCjhdDnx7WWDwxi9JnBYE4CwXmhlYNdSdie4pUP6BAq4e2I6kYRkKA3rWf2h
CEj1FreYvaYV4OFVcF8wVpP1w5vFgOlOKOy19Y/gP5B29qe2O5qIrFmnx8gPV2iV
7kLeWn4ZPoGXoPkC3TYa
=4hNB
-----END PGP SIGNATURE-----

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@openoffice.apache.org
For additional commands, e-mail: users-help@openoffice.apache.org