Mandriva Linux Security Advisory 2010-091 – This update provides a new OpenOffice.org version 3.1.1. An integer underflow might allow remote attackers to execute arbitrary code via crafted records in the document table of a Word document, leading to a heap-based buffer overflow. A heap-based buffer overflow might allow remote attackers to execute arbitrary code via unspecified records in a crafted Word document, related to table parsing. A heap-based buffer overflow allows remote attackers to execute arbitrary code via a crafted EMF file. Multiple heap-based buffer overflows allow remote attackers to execute arbitrary code via a crafted EMF+ file. OpenOffice’s xmlsec uses a bundled Libtool which might load.la file in the current working directory allowing local users to gain privileges via a Trojan horse file. For enabling such vulnerability xmlsec has to use –enable-crypto_dl building flag however it does not, although the fix keeps protected against this threat whenever that flag had been enabled.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/89206/MDVSA-2010-091.txt
Source: https://packetstormsecurity.com/files/89206/Mandriva-Linux-Security-Advisory-2010-091.html