OpenOffice: User-assisted execution of arbitrary code

Background

Apache OpenOffice is an open-source office software suite for word processing, spreadsheets, presentations, graphics, databases and more.

Description

An exploitable out-of-bounds vulnerability exists in OpenOffice Impress when handling MetaActions.

Impact

A remote attacker could entice a user to open a specially crafted OpenDocument Presentation .ODP or Presentation Template .OTP file using OpenOffice Impress, possibly resulting in execution of arbitrary code with the privileges of the process or a Denial of Service condition.

Workaround

There is no known workaround at this time.

Resolution

All OpenOffice users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=app-office/openoffice-bin-4.1.3"