CVE-2012-2665 Manifest-processing errors in Apache OpenOffice 3.4.0
Vendor: The Apache Software Foundation
Apache OpenOffice 3.4.0, all languages, all platforms.
Earlier versions of OpenOffice.org may be also affected.
When OpenOffice reads an ODF document, it first loads and processes
an XML stream within the file called the manifest. Apache OpenOffice
3.4.0 has logic errors that allows a carefully crafted manifest to
cause reads and writes beyond allocated buffers.
No specific exploit has been demonstrated in this case, though such
flaws generally are conducive to exploitation, possibly including
denial of service and elevation of privilege.
OpenOffice users are advised to upgrade to Apache OpenOffice 3.4.1:
Users who are unable to upgrade immediately should exercise caution
when opening untrusted ODF documents.
The Apache OpenOffice Security Team acknowledges Timo Warns of
PRESENSE Technologies GmbH as the discoverer of these flaws.