After five months of development and seven and a half years since the last major release, a corrective release of the Apache OpenOffice 4.1.11 office suite has been formed, which includes 12 fixes. Ready packages have been prepared for Linux, Windows, and macOS.
The new release addresses three vulnerabilities:
- CVE-2021-33035 - allows for code execution upon opening a specially crafted DBF file. The issue arises because OpenOffice relied on the values of fieldLength and fieldType in the DBF file headers when allocating memory, without verifying the actual data type in the fields. An attacker can specify the fieldType as INTEGER but place data of a larger size and provide a fieldLength value that does not correspond to the size of the INTEGER data, which will result in the data tail being written beyond the allocated buffer. As a result of the controlled buffer overflow, the return pointer from the function can be overwritten, and with the use of Return-Oriented Programming (ROP) techniques, the execution of the attacker's code can be achieved.
- CVE-2021-40439 - A DoS attack of the 'Billion laughs' class (XML bomb), leading to exhaustion of available system resources when processing a specially crafted document.
- CVE-2021-28129 - The contents of the DEB package were installed in the system not under the root user.
Changes not related to security:
- The font size in the help section texts has been increased.
- The Insert menu has added an option for managing Fontwork font effects.
- The File menu has added the missing icon for the PDF export function.
- The issue of losing charts when saving in ODS format has been resolved.
- The problem with blocking some useful functions by a confirmation dialog added in the previous release has been resolved (for example, the dialog appeared when referencing a section in the same document).
Source: opennet.ru
