OpenOffice.org has released two patches that repair older versions of its open-source office productivity suite.
The two vulnerabilities do not affect OpenOffice.org's latest 3.0 version, released earlier this month. Software versions prior to version 2.4.2 are affected.
The first vulnerability concerns Windows Metafile (WMF), an image file format, according to an advisory from OpenOffice.org.
The flaw can be exploited if a specially crafted StarOffice or StarSuite document with a WMF file is opened. StarOffice and StarSuite are office products from Sun Microsystems. A remote user would then have the same access privileges to the PC as the victim and could execute arbitrary code. No working exploit has yet been seen.
The second problem is essentially the same, but involves the Enhanced Metafile (EMF) format, an improved version of WMF used for printing graphics.
Again, if a StarOffice or StarSuite document is opened that maliciously manipulates the EMF format, a remote user could run code on the machine. Openoffice.org is unaware of a working exploit.
Comments