CVE-2008-3282
published 2008-08-29CVE-2008-3282: Integer overflow in the rtl_allocateMemory function in sal/rtl/source/alloc_global.c in the memory allocator in OpenOffice.org (OOo) 2.4.1, on 64-bit…
PriorityP336high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
EPSS
10.76%
95.3th percentile
Integer overflow in the rtl_allocateMemory function in sal/rtl/source/alloc_global.c in the memory allocator in OpenOffice.org (OOo) 2.4.1, on 64-bit platforms, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted document, related to a "numeric truncation error," a different vulnerability than CVE-2008-2152.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | openoffice | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
vendor_redhat9.3CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-jvw4-xfqp-q5qh: Integer overflow in the rtl_allocateMemory function in sal/rtl/source/alloc_global
ghsa_unreviewed·2022-05-01·CVSS 9.3
CVE-2008-3282 [CRITICAL] CWE-681 GHSA-jvw4-xfqp-q5qh: Integer overflow in the rtl_allocateMemory function in sal/rtl/source/alloc_global
Integer overflow in the rtl_allocateMemory function in sal/rtl/source/alloc_global.c in the memory allocator in OpenOffice.org (OOo) 2.4.1, on 64-bit platforms, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted document, related to a "numeric truncation error," a different vulnerability than CVE-2008-2152.
Red Hat
openoffice.org: numeric truncation error in memory allocator (64bit)
vendor_redhat·2008-08-27·CVSS 9.3
CVE-2008-3282 [CRITICAL] openoffice.org: numeric truncation error in memory allocator (64bit)
openoffice.org: numeric truncation error in memory allocator (64bit)
Integer overflow in the rtl_allocateMemory function in sal/rtl/source/alloc_global.c in the memory allocator in OpenOffice.org (OOo) 2.4.1, on 64-bit platforms, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted document, related to a "numeric truncation error," a different vulnerability than CVE-2008-2152.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2008-3282 openoffice.org: numeric truncation error in memory allocator (64bit)
bugzilla·2008-08-06·CVSS 7.8
CVE-2008-3282 [HIGH] CVE-2008-3282 openoffice.org: numeric truncation error in memory allocator (64bit)
CVE-2008-3282 openoffice.org: numeric truncation error in memory allocator (64bit)
It was discovered, that OpenOffice.org memory allocator is not 64bit clean.
rtl_allocateMemory() function in sal/rtl/source/alloc_global.c accepts one
argument - sal_Size n. On 64bit platforms such as x86_64, sal_Size is defined
as unsigned long int. This requested memory chunk size is later memory aligned
as size (type sal_Size). size is later used to calculate int index to
g_alloc_table[] array:
int index = (size - 1) >> RTL_MEMALIGN_SHIFT;
However, as sizeof(int) == 4 and sizeof(sal_Size) == 8 on 64bit platforms, the
calculated value may not fit into index (this can happen when
rtl_allocateMemory() is called with large argument, e.g. when some other flaw
causes OpenOffice to attempt to allocate chunk o
Bugzilla
openoffice.org: crash on malformed PCX image (CESA-2008-006)
bugzilla·2008-07-18·CVSS 9.3
[CRITICAL] openoffice.org: crash on malformed PCX image (CESA-2008-006)
openoffice.org: crash on malformed PCX image (CESA-2008-006)
Chris Evans of the Google Security Team reports an Openoffice.org crash
triggered by crafted PCX image:
http://scary.beasts.org/security/CESA-2008-006.html
According to Chris, the issue should no longer affect current upstream 2.4.1,
but may affect unspecified older versions.
Discussion:
Created attachment 312137
a patch
I had taken a look at this today, hence the patch, but do we have any evidence
that it is a security bug now that
http://www.openoffice.org/security/cves/CVE-2008-2152.html is applied ?
---
(In reply to comment #1)
> I had taken a look at this today, hence the patch, but do we have any evidence
> that it is a security bug now that
> http://www.openoffice.org/security/cves/CVE-2008-2152.html is applied ?
CWE
Incorrect Conversion between Numeric Types
mitre_cwe
CWE-681 Incorrect Conversion between Numeric Types
CWE-681: Incorrect Conversion between Numeric Types
When converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values. If the resulting values are used in a sensitive context, then dangerous behaviors may occur.
Modes of Introduction:
Phase: Implementation
Common Consequences:
Scope: Other, Integrity. Impact: Unexpected State, Quality Degradation. The program could wind up using the wrong number and generate incorrect results. If the number is used to allocate resources or make a security decision, then this could introduce a vulnerability.
Detection Methods:
Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of
CWE
Numeric Truncation Error
mitre_cwe
CWE-197 Numeric Truncation Error
CWE-197: Numeric Truncation Error
Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion.
When a primitive is cast to a smaller primitive, the high order bits of the large value are lost in the conversion, potentially resulting in an unexpected value that is not equal to the original value. This value may be required as an index into a buffer, a loop iterator, or simply necessary state data. In any case, the value cannot be trusted and the system will be in an undefined state. While this method may be employed viably to isolate the low bits of a value, this usage is rare, and truncation usually implies that an implementation error has occurred.
Modes of Introduction:
Phase: Implementation
Common Consequences:
Scope: Integrit
http://secunia.com/advisories/31640http://secunia.com/advisories/31646http://secunia.com/advisories/31778http://securitytracker.com/id?1020764http://www.openoffice.org/issues/show_bug.cgi?id=92217http://www.redhat.com/support/errata/RHSA-2008-0835.htmlhttp://www.securityfocus.com/bid/30866http://www.vupen.com/english/advisories/2008/2449https://bugzilla.redhat.com/show_bug.cgi?id=455867https://bugzilla.redhat.com/show_bug.cgi?id=458056https://exchange.xforce.ibmcloud.com/vulnerabilities/44742https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11345https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00120.htmlhttps://www.redhat.com/archives/fedora-package-announce/2008-September/msg00494.htmlhttp://secunia.com/advisories/31640http://secunia.com/advisories/31646http://secunia.com/advisories/31778http://securitytracker.com/id?1020764http://www.openoffice.org/issues/show_bug.cgi?id=92217http://www.redhat.com/support/errata/RHSA-2008-0835.htmlhttp://www.securityfocus.com/bid/30866http://www.vupen.com/english/advisories/2008/2449https://bugzilla.redhat.com/show_bug.cgi?id=455867https://bugzilla.redhat.com/show_bug.cgi?id=458056https://exchange.xforce.ibmcloud.com/vulnerabilities/44742https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11345https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00120.htmlhttps://www.redhat.com/archives/fedora-package-announce/2008-September/msg00494.html
2008-08-29
Published