CVE-2010-3450 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	9.3 UNKNOWN	NETWORK	MEDIUM		AV:N/AC:M/Au:N/C:C/I:C/A:C

Base Score

CVSS 3.x

EPSS Score

Percentile: 85%

Affected Products (NVD)

Vendor	Product	Version
apache	openoffice	2.0.0 ≤ 𝑥 < 3.3.0
canonical	ubuntu_linux	8.04
canonical	ubuntu_linux	9.10
canonical	ubuntu_linux	10.04
canonical	ubuntu_linux	10.10
debian	debian_linux	5.0
debian	debian_linux	6.0

𝑥

= Vulnerable software versions

Ubuntu Releases

Ubuntu Product

Codename

libreoffice

dapper	dne
hardy	dne
karmic	dne
lucid	dne
maverick	dne

openoffice.org

dapper	ignored
hardy	Fixed 1:2.4.1-1ubuntu2.5 released
karmic	Fixed 1:3.1.1-5ubuntu1.3 released
lucid	Fixed 1:3.2.0-7ubuntu4.2 released
maverick	Fixed 1:3.2.1-7ubuntu1.1 released

Common Weakness Enumeration

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References

http://osvdb.org/70711

http://secunia.com/advisories/40775

http://secunia.com/advisories/42999

http://secunia.com/advisories/43065

http://secunia.com/advisories/43105

http://secunia.com/advisories/43118

http://secunia.com/advisories/60799

http://ubuntu.com/usn/usn-1056-1

http://www.debian.org/security/2011/dsa-2151

http://www.gentoo.org/security/en/glsa/glsa-201408-19.xml

http://www.mandriva.com/security/advisories?name=MDVSA-2011:027

http://www.openoffice.org/security/cves/CVE-2010-3450.html

http://www.oracle.com/technetwork/topics/security/cpuapr2011-301950.html

http://www.redhat.com/support/errata/RHSA-2011-0181.html

http://www.redhat.com/support/errata/RHSA-2011-0182.html

http://www.securityfocus.com/bid/46031

http://www.securitytracker.com/id?1025002

http://www.vupen.com/english/advisories/2011/0230

http://www.vupen.com/english/advisories/2011/0232

http://www.vupen.com/english/advisories/2011/0279

https://bugzilla.redhat.com/show_bug.cgi?id=602324

http://osvdb.org/70711

http://secunia.com/advisories/40775

http://secunia.com/advisories/42999

http://secunia.com/advisories/43065

http://secunia.com/advisories/43105

http://secunia.com/advisories/43118

http://secunia.com/advisories/60799

http://ubuntu.com/usn/usn-1056-1

http://www.debian.org/security/2011/dsa-2151

http://www.gentoo.org/security/en/glsa/glsa-201408-19.xml

http://www.mandriva.com/security/advisories?name=MDVSA-2011:027

http://www.openoffice.org/security/cves/CVE-2010-3450.html

http://www.oracle.com/technetwork/topics/security/cpuapr2011-301950.html

http://www.redhat.com/support/errata/RHSA-2011-0181.html

http://www.redhat.com/support/errata/RHSA-2011-0182.html

http://www.securityfocus.com/bid/46031

http://www.securitytracker.com/id?1025002

http://www.vupen.com/english/advisories/2011/0230

http://www.vupen.com/english/advisories/2011/0232

http://www.vupen.com/english/advisories/2011/0279

https://bugzilla.redhat.com/show_bug.cgi?id=602324