CVE-2010-3453

CRITICAL 9.3CVE-2010-3453 · Published 28/01/2011 · updated 16/06/2026

In short

CVE-2010-3453 is a CRITICAL (CVSS 9.3) vulnerability affecting openoffice (apache).
Chance of exploitation in the next 30 days (EPSS): 9.7%, higher than 95.5% of all vulnerabilities.
Fix: update to 3.3.0 or later.

Package	Affected versions	Patched versions
openoffice apache	`≥ 2.0.0, < 3.3.0`	`3.3.0`

Description

The WW8ListManager::WW8ListManager function in oowriter in OpenOffice.org (OOo) 2.x and 3.x before 3.3 does not properly handle an unspecified number of list levels in user-defined list styles in WW8 data in a Microsoft Word document, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted .DOC file that triggers an out-of-bounds write.

References

osvdb.org/70714 · Broken Link
secunia.com/advisories/40775 · Broken Link
secunia.com/advisories/42999 · Broken Link
secunia.com/advisories/43065 · Broken Link
secunia.com/advisories/43105 · Broken Link
secunia.com/advisories/43118 · Broken Link
secunia.com/advisories/60799 · Broken Link
ubuntu.com/usn/usn-1056-1 · Third Party Advisory
cs.brown.edu/people/drosenbe/research.html · Broken Link
debian.org/security/2011/dsa-2151 · Third Party Advisory
gentoo.org/security/en/glsa/glsa-201408-19.xml · Third Party Advisory
mandriva.com/security/advisories · Broken Link
openoffice.org/security/cves/CVE-2010-3453_CVE-2010-3454.html

More vulnerabilities in openoffice

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

openoffice

apache

≥ 2.0.0, < 3.3.0

3.3.0

Description

More vulnerabilities in openoffice

See all →