Users are being urged to install both updates, which address flaws in the open-source productivity suite which could be used by an attacker to remotely execute code on targeted systems.
Both vulnerabilities affect all versions of Open Office prior to the 2.4.2 release. The recently-unveiled Open Office 3.0 release is not believed to be at risk from either vulnerability.
The flaws center on the way OpenOffice handles certain file types. An attacker could use a specially-crafted WMF or EMF file to cause a heap overflow error which would then leave the attacker able to execute malicious code on the targeted system.
No working exploit for either vulnerability is thought to exist in the wild. Credit for the discovery of both flaws was given to an anonymous researcher operating out of Chinese security firm SureRun.
The French Security Incident Response Team has rated both flaws as critical, the highest of its four alert levels. Both FrSIRT and the US Computer Emergency Response Team are advising users to update their copies of OpenOffice to protect from the vulnerabilities.
Open Office gets security fixes
By
Shaun Nichols
on Oct 31, 2008 3:13PM
A pair of security fixes have been posted for Open Office.
Got a news tip for our journalists? Share it with us anonymously here.
Partner Content
Promoted Content
Australian data sovereignty and protection concerns increase
Promoted Content
Why IT spending should be transformational, not just transactional
Promoted Content
Critical considerations for moving to the cloud
Promoted Content
NDR comes of age as frontline security application
Sponsored Whitepapers
The CISO View 2021 Survey: Zero Trust and Privileged Access
How and why to backup your Office 365 tenant
ForgeRock for Australia’s Trusted Digital Identity Framework (TDIF)
How engineering has been operating in the dark and what to do about it
The Top Six Digital Transformation Trends Shaping Business and Society
