CVE-2010-0136

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2010-0136
OpenOffice.org (OOo) 2.0.4, 2.4.1, and 3.1.1 does not properly enforce Visual Basic for Applications (VBA) macro security settings, which allows remote attackers to run arbitrary macros via a crafted document.

9.3 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability : 8.6 / Impact : 10.0

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References
Link Resource
http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00005.html Third Party Advisory
http://secunia.com/advisories/38695 Broken Link
http://secunia.com/advisories/38921 Broken Link
http://securitytracker.com/id?1023588 Broken Link Third Party Advisory VDB Entry
http://www.debian.org/security/2010/dsa-1995 Third Party Advisory
http://www.mail-archive.com/debian-openoffice%40lists.debian.org/msg23178.html
http://www.mandriva.com/security/advisories?name=MDVSA-2010:221 Broken Link
http://www.securityfocus.com/bid/38245 Broken Link Third Party Advisory VDB Entry
http://www.ubuntu.com/usn/USN-903-1 Third Party Advisory
http://www.vupen.com/english/advisories/2010/0635 Broken Link
http://www.vupen.com/english/advisories/2010/2905 Broken Link
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:apache:openoffice:2.0.4:*:*:*:*:*:*:*
cpe:2.3:a:apache:openoffice:2.4.1:*:*:*:*:*:*:*
cpe:2.3:a:apache:openoffice:3.1.1:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:-:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:8.10:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:9.04:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:9.10:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:4.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:5.0:*:*:*:*:*:*:*
History

07 Nov 2023, 02:05

Type Values Removed Values Added
References
  • {'url': 'http://www.mail-archive.com/debian-openoffice@lists.debian.org/msg23178.html', 'name': '[debian-openoffice] 20100212 ./packages/openofficeorg/3.1.1/unstable r1866: merge 1:3.1.1-15+squeeze1', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': 'MLIST'}
  • () http://www.mail-archive.com/debian-openoffice%40lists.debian.org/msg23178.html -

07 Feb 2022, 17:04

Type Values Removed Values Added
CWE CWE-264 CWE-77
References (SECTRACK) http://securitytracker.com/id?1023588 - (SECTRACK) http://securitytracker.com/id?1023588 - Broken Link, Third Party Advisory, VDB Entry
References (DEBIAN) http://www.debian.org/security/2010/dsa-1995 - (DEBIAN) http://www.debian.org/security/2010/dsa-1995 - Third Party Advisory
References (MLIST) http://www.mail-archive.com/debian-openoffice@lists.debian.org/msg23178.html - (MLIST) http://www.mail-archive.com/debian-openoffice@lists.debian.org/msg23178.html - Mailing List, Third Party Advisory
References (UBUNTU) http://www.ubuntu.com/usn/USN-903-1 - (UBUNTU) http://www.ubuntu.com/usn/USN-903-1 - Third Party Advisory
References (MANDRIVA) http://www.mandriva.com/security/advisories?name=MDVSA-2010:221 - (MANDRIVA) http://www.mandriva.com/security/advisories?name=MDVSA-2010:221 - Broken Link
References (VUPEN) http://www.vupen.com/english/advisories/2010/0635 - (VUPEN) http://www.vupen.com/english/advisories/2010/0635 - Broken Link
References (SECUNIA) http://secunia.com/advisories/38921 - (SECUNIA) http://secunia.com/advisories/38921 - Broken Link
References (BID) http://www.securityfocus.com/bid/38245 - (BID) http://www.securityfocus.com/bid/38245 - Broken Link, Third Party Advisory, VDB Entry
References (SECUNIA) http://secunia.com/advisories/38695 - (SECUNIA) http://secunia.com/advisories/38695 - Broken Link
References (SUSE) http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00005.html - (SUSE) http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00005.html - Third Party Advisory
References (VUPEN) http://www.vupen.com/english/advisories/2010/2905 - (VUPEN) http://www.vupen.com/english/advisories/2010/2905 - Broken Link
CPE cpe:2.3:a:sun:openoffice.org:2.0.4:*:*:*:*:*:*:*
cpe:2.3:a:sun:openoffice.org:2.4.1:*:*:*:*:*:*:*
cpe:2.3:a:sun:openoffice.org:3.1.1:*:*:*:*:*:*:*		 cpe:2.3:a:apache:openoffice:2.4.1:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:9.10:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:-:*:*:*
cpe:2.3:o:debian:debian_linux:5.0:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:9.04:*:*:*:*:*:*:*
cpe:2.3:a:apache:openoffice:3.1.1:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:4.0:*:*:*:*:*:*:*
cpe:2.3:a:apache:openoffice:2.0.4:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:8.10:*:*:*:*:*:*:*
First Time Debian debian Linux
Debian
Canonical ubuntu Linux
Apache
Apache openoffice
Canonical
Information

Published : 2010-02-16 19:30

Updated : 2023-12-10 11:03

NVD link : CVE-2010-0136

Mitre link : CVE-2010-0136

CVE.ORG link : CVE-2010-0136

JSON object : View

Products Affected

apache

  • openoffice

canonical

  • ubuntu_linux

debian

  • debian_linux
CWE
CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')