CVE-2009-2949

Severity: critical (CVSS 9.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 14.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2010-02-16 · updated 2026-06-16
Weakness: CWE-190

Description

Integer overflow in the XPMReader::ReadXPM function in filter.vcl/ixpm/svt_xpmread.cxx in OpenOffice.org (OOo) before 3.2 allows remote attackers to execute arbitrary code via a crafted XPM file that triggers a heap-based buffer overflow.

Affected products

Apache Software Foundation Apache OpenOffice: before 3.2.0 — fixed in 3.2.0
Canonical Ubuntu Linux: 8.04, 8.10, 9.04, 9.10
Debian Linux: 4.0, 5.0

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache OpenOffice 3.2.0. Check the vendor advisory for mitigations.

References

http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00005.html
http://secunia.com/advisories/38567
http://secunia.com/advisories/38568
http://secunia.com/advisories/38695
http://secunia.com/advisories/38921
http://secunia.com/advisories/41818
http://secunia.com/advisories/60799
http://securitytracker.com/id?1023591
http://www.debian.org/security/2010/dsa-1995
http://www.gentoo.org/security/en/glsa/glsa-201408-19.xml
http://www.mandriva.com/security/advisories?name=MDVSA-2010:221
http://www.openoffice.org/security/bulletin.html

Get alerted when CVE-2009-2949 or the next vulnerability affects your stack