Vulnerability in OpenOffice.org Database Engine
Summary
DSA-1419-1: openoffice.org. Affects openoffice.org versions < 2.0.4.dfsg.2-7etch4. Fixed in 2.0.4.dfsg.2-7etch4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenOffice.org is an open-source office productivity suite that includes a database engine called HSQLDB. HSQLDB is the default database engine shipped with OpenOffice.org. It provides a relational database management system for storing and manipulating data. However, a vulnerability has been discovered in HSQLDB that allows for the execution of arbitrary Java code embedded in an OpenOffice.org database document with the user's privileges.
Vulnerability Detail
The vulnerability in HSQLDB could allow an attacker to embed malicious Java code within an OpenOffice.org database document. When the document is opened, the embedded code is executed with the user's privileges, potentially leading to unauthorized access, data manipulation, or other malicious activities. This vulnerability affects OpenOffice.org versions prior to 2.0.4.dfsg.2-7etch4 and HSQLDB versions prior to 1.8.0.7-1etch1.
How To Fix
Minimum fixed version
2.0.4.dfsg.2-7etch4
This is the first release that contains the fix.
sudo apt-get install --only-upgrade openoffice.orgTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the provided updates to OpenOffice.org and HSQLDB as soon as possible.
Conclusion
In conclusion, a vulnerability has been discovered in the HSQLDB database engine shipped with OpenOffice.org. This vulnerability allows for the execution of arbitrary Java code embedded in an OpenOffice.org database document, potentially leading to unauthorized access or data manipulation. It is recommended to upgrade both OpenOffice.org and HSQLDB to the fixed versions mentioned above. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for openoffice.org →
FAQ
OpenOffice.org is an open-source office productivity suite that includes word processing, spreadsheet, presentation, and database software.
HSQLDB is the default database engine shipped with OpenOffice.org. It provides a relational database management system for storing and manipulating data.
This vulnerability allows for the execution of arbitrary Java code embedded in an OpenOffice.org database document, potentially leading to unauthorized access or data manipulation.
There are no known exploits for this vulnerability at this time.
You can use Vulert's playground (https://vulert.com/scanner) to check if your OpenOffice.org installation is affected by this vulnerability. Simply upload your package-lock.json file to the playground and it will provide real-time monitoring and alerts for open-source vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for openoffice.org.
