CVE-2009-2949

Published: Feb 16, 2010Modified: Apr 29, 2026

9.3

Vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability: 8.6 / Impact: 10.0

Source: NVD

Description

Integer overflow in the XPMReader::ReadXPM function in filter.vcl/ixpm/svt_xpmread.cxx in OpenOffice.org (OOo) before 3.2 allows remote attackers to execute arbitrary code via a crafted XPM file that triggers a heap-based buffer overflow.

Affected (7)

Products: Apache: Openoffice · Canonical: Ubuntu Linux · Debian: Debian Linux

1 product

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Openoffice	Before 3.2.0

Configuration B

6 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 8.04
Canonical Ubuntu Linux	Version 8.10
Canonical Ubuntu Linux	Version 9.04
Canonical Ubuntu Linux	Version 9.10
Debian Debian Linux	Version 4.0
Debian Debian Linux	Version 5.0

Related CWEs

CWE-190

Integer Overflow or Wraparound

The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

References (48)

http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00005.html

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/38567

Source: cve@mitre.org

Broken Link

http://secunia.com/advisories/38568

Source: cve@mitre.org

Broken Link

http://secunia.com/advisories/38695

Source: cve@mitre.org

Broken Link

http://secunia.com/advisories/38921

Source: cve@mitre.org

Broken Link

http://secunia.com/advisories/41818

Source: cve@mitre.org

Broken Link

http://secunia.com/advisories/60799

Source: cve@mitre.org

Broken Link

http://securitytracker.com/id?1023591

Source: cve@mitre.org

Broken LinkThird Party AdvisoryVDB Entry

http://www.debian.org/security/2010/dsa-1995

Source: cve@mitre.org

Third Party Advisory

http://www.gentoo.org/security/en/glsa/glsa-201408-19.xml

Source: cve@mitre.org

Third Party Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2010:221

Source: cve@mitre.org

Broken Link

http://www.openoffice.org/security/bulletin.html

Source: cve@mitre.org

Vendor Advisory

http://www.openoffice.org/security/cves/CVE-2009-2949.html

Source: cve@mitre.org

Vendor Advisory

http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html

Source: cve@mitre.org

Third Party Advisory

http://www.redhat.com/support/errata/RHSA-2010-0101.html

Source: cve@mitre.org

Broken Link

http://www.securityfocus.com/bid/38218

Source: cve@mitre.org

Broken LinkThird Party AdvisoryVDB Entry

http://www.ubuntu.com/usn/USN-903-1

Source: cve@mitre.org

Third Party Advisory

http://www.us-cert.gov/cas/techalerts/TA10-287A.html

Source: cve@mitre.org

Third Party AdvisoryUS Government Resource

http://www.vupen.com/english/advisories/2010/0366

Source: cve@mitre.org

Broken LinkPatch

http://www.vupen.com/english/advisories/2010/0635

Source: cve@mitre.org

Broken Link

http://www.vupen.com/english/advisories/2010/2905

Source: cve@mitre.org

Broken Link

https://bugzilla.redhat.com/show_bug.cgi?id=527540

Source: cve@mitre.org

Issue TrackingThird Party Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/56236

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10176

Source: cve@mitre.org

Tool Signature

http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00005.html