simpress.bin in the Impress module in OpenOffice.org (OOo) 2.x and 3.x before 3.3 does not properly handle integer values associated with dictionary property items, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PowerPoint document that triggers a heap-based buffer overflow, related to an integer truncation error.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Openoffice.org | Openoffice | 3.2.1 (including) | 3.2.1 (including) |
| Red Hat Enterprise Linux 3 | RedHat | openoffice.org-0:1.1.2-48.2.0.EL3 | * |
| Red Hat Enterprise Linux 4 | RedHat | openoffice.org-0:1.1.5-10.6.0.7.EL4.5 | * |
| Red Hat Enterprise Linux 4 | RedHat | openoffice.org2-1:2.0.4-5.7.0.6.1.el4_8.6 | * |
| Openoffice.org | Ubuntu | dapper | * |
| Openoffice.org | Ubuntu | hardy | * |
| Openoffice.org | Ubuntu | jaunty | * |
| Openoffice.org | Ubuntu | karmic | * |
| Openoffice.org | Ubuntu | lucid | * |
| Openoffice.org | Ubuntu | maverick | * |