Vulnerability Description
Multiple directory traversal vulnerabilities in OpenOffice.org (OOo) 2.x and 3.x before 3.3 allow remote attackers to overwrite arbitrary files via a .. (dot dot) in an entry in (1) an XSLT JAR filter description file, (2) an Extension (aka OXT) file, or unspecified other (3) JAR or (4) ZIP files.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Openoffice | >= 2.0.0, < 3.3.0 |
| Canonical | Ubuntu Linux | 8.04 |
| Debian | Debian Linux | 5.0 |
Related Weaknesses (CWE)
References
- http://osvdb.org/70711Broken Link
- http://secunia.com/advisories/40775Broken Link
- http://secunia.com/advisories/42999Broken Link
- http://secunia.com/advisories/43065Broken Link
- http://secunia.com/advisories/43105Broken Link
- http://secunia.com/advisories/43118Broken Link
- http://secunia.com/advisories/60799Broken Link
- http://ubuntu.com/usn/usn-1056-1Third Party Advisory
- http://www.debian.org/security/2011/dsa-2151Third Party Advisory
- http://www.gentoo.org/security/en/glsa/glsa-201408-19.xmlThird Party Advisory
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:027Broken Link
- http://www.openoffice.org/security/cves/CVE-2010-3450.htmlVendor Advisory
- http://www.oracle.com/technetwork/topics/security/cpuapr2011-301950.htmlThird Party Advisory
- http://www.redhat.com/support/errata/RHSA-2011-0181.htmlBroken Link
- http://www.redhat.com/support/errata/RHSA-2011-0182.htmlBroken Link
FAQ
What is CVE-2010-3450?
CVE-2010-3450 is a vulnerability with a CVSS score of 9.3 (HIGH). Multiple directory traversal vulnerabilities in OpenOffice.org (OOo) 2.x and 3.x before 3.3 allow remote attackers to overwrite arbitrary files via a .. (dot dot) in an entry in (1) an XSLT JAR filter...
How severe is CVE-2010-3450?
CVE-2010-3450 has been rated HIGH with a CVSS base score of 9.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2010-3450?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Openoffice, Canonical Ubuntu Linux, Debian Debian Linux.