CVE-2021-33035
A carefully crafted document could overflow the allocated space, leading to the execution of arbitrary code by altering the contents of the program stack.
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 50.6%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.
Description
Apache OpenOffice opens dBase/DBF documents and shows the contents as spreadsheets. DBF are database files with data organized in fields. When reading DBF data the size of certain fields is not checked: the data is just copied into local variables. A carefully crafted document could overflow the allocated space, leading to the execution of arbitrary code by altering the contents of the program stack. This issue affects Apache OpenOffice up to and including version 4.1.10
- CVSS 3.1
- 7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- EPSS
- 50.56% probability · 99th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-120
- Affected
- apache/openoffice
- Source
- security@apache.org
References
- http://www.openwall.com/lists/oss-security/2021/10/07/3Mailing List, Patch, Third Party Advisory
- https://github.com/apache/openoffice/commit/efddaef0151af3be16078cc4d88c6bae0f911e56#diff-ea66e734dd358922aba12ad4ba39c96bdc6cbde587d07dbc63d04daa0a30e90fPatch, Third Party Advisory
- https://lists.apache.org/thread.html/r1ab8532e11f41bc7ca057ac7e39cab25f2e1f9d5f4929788ae21c8b9%40%3Cusers.openoffice.apache.org%3E
- https://lists.apache.org/thread.html/r929c0c6a53cad64a1007b878342756badbb05ddd9b8f31a6d0b424cb%40%3Cannounce.apache.org%3E
- http://www.openwall.com/lists/oss-security/2021/10/07/3Mailing List, Patch, Third Party Advisory
- https://github.com/apache/openoffice/commit/efddaef0151af3be16078cc4d88c6bae0f911e56#diff-ea66e734dd358922aba12ad4ba39c96bdc6cbde587d07dbc63d04daa0a30e90fPatch, Third Party Advisory
- https://lists.apache.org/thread.html/r1ab8532e11f41bc7ca057ac7e39cab25f2e1f9d5f4929788ae21c8b9%40%3Cusers.openoffice.apache.org%3E
- https://lists.apache.org/thread.html/r929c0c6a53cad64a1007b878342756badbb05ddd9b8f31a6d0b424cb%40%3Cannounce.apache.org%3E
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.