Your submission was sent successfully! Close

CVE-2010-0395

Published: 8 June 2010

OpenOffice.org 2.x and 3.0 before 3.2.1 allows user-assisted remote attackers to bypass Python macro security restrictions and execute arbitrary Python code via a crafted OpenDocument Text (ODT) file that triggers code execution when the macro directory structure is previewed.

From the Ubuntu security team

Marc Schoenefeld discovered that OpenOffice.org would run document macros from the macro browser, even when macros were disabled. If a user were tricked into opening a specially crafted document and examining a macro, a remote attacker could execute arbitrary code with user privileges.

Priority

Medium

Status

Package Release Status
openoffice.org
Launchpad, Ubuntu, Debian
dapper Ignored
(reached end-of-life)
hardy
Released (1:2.4.1-1ubuntu2.4)
jaunty
Released (1:3.0.1-9ubuntu3.3)
karmic
Released (1:3.1.1-5ubuntu1.2)
lucid
Released (1:3.2.0-7ubuntu4.1)
upstream
Released (3.2.1)