CVE-2010-3689 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	6.9 UNKNOWN	LOCAL	MEDIUM		AV:L/AC:M/Au:N/C:C/I:C/A:C
redhat	CNA	---				---
CVE	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 6%

Vendor	Product	Version
apache	openoffice	3.0.0 ≤ 𝑥 < 3.3.0
canonical	ubuntu_linux	8.04
canonical	ubuntu_linux	9.10
canonical	ubuntu_linux	10.04
canonical	ubuntu_linux	10.10
debian	debian_linux	5.0
debian	debian_linux	6.0

𝑥

= Vulnerable software versions

Ubuntu Releases

Ubuntu Product

Codename

libreoffice

maverick	dne
lucid	dne
karmic	dne
hardy	dne
dapper	dne

openoffice.org

maverick	Fixed 1:3.2.1-7ubuntu1.1 released
lucid	Fixed 1:3.2.0-7ubuntu4.2 released
karmic	Fixed 1:3.1.1-5ubuntu1.3 released
hardy	Fixed 1:2.4.1-1ubuntu2.5 released
dapper	ignored

Common Weakness Enumeration

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References

http://osvdb.org/70716

http://secunia.com/advisories/40775

http://secunia.com/advisories/42999

http://secunia.com/advisories/43065

http://secunia.com/advisories/43105

http://secunia.com/advisories/60799

http://ubuntu.com/usn/usn-1056-1

http://www.debian.org/security/2011/dsa-2151

http://www.gentoo.org/security/en/glsa/glsa-201408-19.xml

http://www.mandriva.com/security/advisories?name=MDVSA-2011:027

http://www.openoffice.org/security/cves/CVE-2010-3689.html

http://www.oracle.com/technetwork/topics/security/cpuapr2011-301950.html

http://www.redhat.com/support/errata/RHSA-2011-0182.html

http://www.securityfocus.com/bid/46031

http://www.securitytracker.com/id?1025004

http://www.vupen.com/english/advisories/2011/0230

http://www.vupen.com/english/advisories/2011/0232

http://www.vupen.com/english/advisories/2011/0279

https://bugzilla.redhat.com/show_bug.cgi?id=641224

http://osvdb.org/70716

http://secunia.com/advisories/40775

http://secunia.com/advisories/42999

http://secunia.com/advisories/43065

http://secunia.com/advisories/43105

http://secunia.com/advisories/60799

http://ubuntu.com/usn/usn-1056-1

http://www.debian.org/security/2011/dsa-2151

http://www.gentoo.org/security/en/glsa/glsa-201408-19.xml

http://www.mandriva.com/security/advisories?name=MDVSA-2011:027

http://www.openoffice.org/security/cves/CVE-2010-3689.html

http://www.oracle.com/technetwork/topics/security/cpuapr2011-301950.html

http://www.redhat.com/support/errata/RHSA-2011-0182.html

http://www.securityfocus.com/bid/46031

http://www.securitytracker.com/id?1025004

http://www.vupen.com/english/advisories/2011/0230

http://www.vupen.com/english/advisories/2011/0232

http://www.vupen.com/english/advisories/2011/0279

https://bugzilla.redhat.com/show_bug.cgi?id=641224