CVE-2006-5870

Severity: critical (CVSS 9.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 8.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2006-12-31 · updated 2026-06-16
Weakness: CWE-189

Description

Multiple integer overflows in OpenOffice.org (OOo) 2.0.4 and earlier, and possibly other versions before 2.1.0; and StarOffice 6 through 8; allow user-assisted remote attackers to execute arbitrary code via a crafted (a) WMF or (b) EMF file that triggers heap-based buffer overflows in (1) wmf/winwmf.cxx, during processing of META_ESCAPE records; and wmf/enhwmf.cxx, during processing of (2) EMR_POLYPOLYGON and (3) EMR_POLYPOLYGON16 records.

Affected products

Openoffice: through 2.0.4
Sun Staroffice: 6.0, 7.0, 8.0

References

http://archives.neohapsis.com/archives/vulnwatch/2007-q1/0002.htmly
http://fedoranews.org/cms/node/2344
http://lists.suse.com/archive/suse-security-announce/2007-Jan/0001.html
http://osvdb.org/32610
http://osvdb.org/32611
http://secunia.com/advisories/23549
http://secunia.com/advisories/23600
http://secunia.com/advisories/23612
http://secunia.com/advisories/23616
http://secunia.com/advisories/23620
http://secunia.com/advisories/23682

Get alerted when CVE-2006-5870 or the next vulnerability affects your stack