CVE-2007-4575: openoffice Improper Control of Generation of Code

Modified

AliasesRHSA-2007:1090DEBIAN-CVE-2007-4575DSA-1419-1

Published 06-12-2007Last modified 07-08-2024

Vulnerability summary

CVE-2007-4575 is a high (CVSS 9.3) Improper Control of Generation of Code vulnerability in openoffice. EPSS estimates a 14.28% chance of exploitation in the next 30 days, higher than 96.6% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 9.3, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

9.3/10

010

High · v2.0 (NVD)

EPSS score

14.28%

0%100%

Medium · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 4 · Duplicates 1

RHSA-2007:1048 RHSA-2008:0151 RHSA-2008:0158 RHSA-2008:0213 CVE-2007-4576

Timeline

06-12-2007
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

HSQLDB before 1.8.0.9, as used in OpenOffice.org (OOo) 2 before 2.3.1, allows user-assisted remote attackers to execute arbitrary Java code via crafted database documents, related to "exposing static java methods."

CVSS metrics

1 score · 1 source · 1 version

v2.09.3

EPSS trend

Probability

14.28%

Chance of exploitation in the next 30 days

Percentile

97%

Versus all other CVEs

30-day change

No change 0.00 pp

From 14.28% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-94Improper Control of Generation of CodeThe product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Affected systems

Version check

Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.

Redhat60 products

openoffice.org2< 1:2.0.4-5.7.0.3.0
openoffice.org2-base< 1:2.0.4-5.7.0.3.0
openoffice.org2-calc< 1:2.0.4-5.7.0.3.0
openoffice.org2-core< 1:2.0.4-5.7.0.3.0
openoffice.org2-debuginfo< 1:2.0.4-5.7.0.3.0

openoffice.org2-draw< 1:2.0.4-5.7.0.3.0
openoffice.org2-emailmerge< 1:2.0.4-5.7.0.3.0
openoffice.org2-graphicfilter< 1:2.0.4-5.7.0.3.0
openoffice.org2-impress< 1:2.0.4-5.7.0.3.0
openoffice.org2-javafilter< 1:2.0.4-5.7.0.3.0
openoffice.org2-langpack-af_ZA< 1:2.0.4-5.7.0.3.0
openoffice.org2-langpack-ar< 1:2.0.4-5.7.0.3.0
openoffice.org2-langpack-bg_BG< 1:2.0.4-5.7.0.3.0
openoffice.org2-langpack-bn< 1:2.0.4-5.7.0.3.0
openoffice.org2-langpack-ca_ES< 1:2.0.4-5.7.0.3.0
openoffice.org2-langpack-cs_CZ< 1:2.0.4-5.7.0.3.0
openoffice.org2-langpack-cy_GB< 1:2.0.4-5.7.0.3.0
openoffice.org2-langpack-da_DK< 1:2.0.4-5.7.0.3.0
openoffice.org2-langpack-de< 1:2.0.4-5.7.0.3.0
openoffice.org2-langpack-el_GR< 1:2.0.4-5.7.0.3.0
openoffice.org2-langpack-es< 1:2.0.4-5.7.0.3.0
openoffice.org2-langpack-et_EE< 1:2.0.4-5.7.0.3.0
openoffice.org2-langpack-eu_ES< 1:2.0.4-5.7.0.3.0
openoffice.org2-langpack-fi_FI< 1:2.0.4-5.7.0.3.0
openoffice.org2-langpack-fr< 1:2.0.4-5.7.0.3.0
openoffice.org2-langpack-ga_IE< 1:2.0.4-5.7.0.3.0
openoffice.org2-langpack-gl_ES< 1:2.0.4-5.7.0.3.0
openoffice.org2-langpack-gu_IN< 1:2.0.4-5.7.0.3.0
openoffice.org2-langpack-he_IL< 1:2.0.4-5.7.0.3.0
openoffice.org2-langpack-hi_IN< 1:2.0.4-5.7.0.3.0
openoffice.org2-langpack-hr_HR< 1:2.0.4-5.7.0.3.0
openoffice.org2-langpack-hu_HU< 1:2.0.4-5.7.0.3.0
openoffice.org2-langpack-it< 1:2.0.4-5.7.0.3.0
openoffice.org2-langpack-ja_JP< 1:2.0.4-5.7.0.3.0
openoffice.org2-langpack-ko_KR< 1:2.0.4-5.7.0.3.0
openoffice.org2-langpack-lt_LT< 1:2.0.4-5.7.0.3.0
openoffice.org2-langpack-ms_MY< 1:2.0.4-5.7.0.3.0
openoffice.org2-langpack-nb_NO< 1:2.0.4-5.7.0.3.0
openoffice.org2-langpack-nl< 1:2.0.4-5.7.0.3.0
openoffice.org2-langpack-nn_NO< 1:2.0.4-5.7.0.3.0
openoffice.org2-langpack-pa_IN< 1:2.0.4-5.7.0.3.0
openoffice.org2-langpack-pl_PL< 1:2.0.4-5.7.0.3.0
openoffice.org2-langpack-pt_BR< 1:2.0.4-5.7.0.3.0
openoffice.org2-langpack-pt_PT< 1:2.0.4-5.7.0.3.0
openoffice.org2-langpack-ru< 1:2.0.4-5.7.0.3.0
openoffice.org2-langpack-sk_SK< 1:2.0.4-5.7.0.3.0
openoffice.org2-langpack-sl_SI< 1:2.0.4-5.7.0.3.0
openoffice.org2-langpack-sr_CS< 1:2.0.4-5.7.0.3.0
openoffice.org2-langpack-sv< 1:2.0.4-5.7.0.3.0
openoffice.org2-langpack-ta_IN< 1:2.0.4-5.7.0.3.0
openoffice.org2-langpack-th_TH< 1:2.0.4-5.7.0.3.0
openoffice.org2-langpack-tr_TR< 1:2.0.4-5.7.0.3.0
openoffice.org2-langpack-zh_CN< 1:2.0.4-5.7.0.3.0
openoffice.org2-langpack-zh_TW< 1:2.0.4-5.7.0.3.0
openoffice.org2-langpack-zu_ZA< 1:2.0.4-5.7.0.3.0
openoffice.org2-math< 1:2.0.4-5.7.0.3.0
openoffice.org2-pyuno< 1:2.0.4-5.7.0.3.0
openoffice.org2-testtools< 1:2.0.4-5.7.0.3.0
openoffice.org2-writer< 1:2.0.4-5.7.0.3.0
openoffice.org2-xsltfilter< 1:2.0.4-5.7.0.3.0

Show all 60

Debian2 products

hsqldb< 1.8.0.7-1etch1 | < 1.8.0.9-1
openoffice.org< 2.0.4.dfsg.2-7etch4

Openoffice1 product

openoffice≤ 2.3 | 2.0.1 | 2.0.2 | 2.0.3 | 2.0.3_1 | 2.0.4 | 2.0beta | 2.1 | 2.2 | 2.2.1

3 vendors · 63 products

References

44 links

secunia.com/advisories/28585Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.redhat.com/support/errata/RHSA-2008-0213.htmlVendor AdvisoryX Refsource REDHAT
secunia.com/advisories/28018Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.vupen.com/english/advisories/2007/4146VDB EntryX Refsource VUPENVendor Advisory
sunsolve.sun.com/search/document.do?assetkey=1-66-200637-1Vendor AdvisoryX Refsource SUNALERT
www.securityfocus.com/bid/26703VDB EntryX Refsource BIDPatch
www.gentoo.org/security/en/glsa/glsa-200712-25.xmlVendor AdvisoryX Refsource GENTOO
exchange.xforce.ibmcloud.com/vulnerabilities/38882VDB EntryX Refsource XF
www.redhat.com/archives/fedora-package-announce/2008-January/msg00753.htmlVendor AdvisoryX Refsource FEDORA
www.redhat.com/support/errata/RHSA-2008-0151.htmlVendor AdvisoryX Refsource REDHAT

Show all 44 references

oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10153VDB EntrySignatureX Refsource OVAL
secunia.com/advisories/27914Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/27972Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/30100Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.mandriva.com/security/advisories?name=MDVSA-2008:095Vendor AdvisoryX Refsource MANDRIVA
lists.opensuse.org/opensuse-security-announce/2007-12/msg00005.htmlVendor AdvisoryX Refsource SUSE
secunia.com/advisories/27916Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/28286Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.debian.org/security/2007/dsa-1419Vendor AdvisoryX Refsource DEBIAN
bugs.gentoo.org/show_bug.cgi?id=201799X Refsource MISC
secunia.com/advisories/27928Third Party AdvisoryX Refsource SECUNIAPatchVendor Advisory
bugs.gentoo.org/show_bug.cgi?id=200771X Refsource MISC
www.vupen.com/english/advisories/2007/4092VDB EntryX Refsource VUPENVendor Advisory
secunia.com/advisories/28039Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.securitytracker.com/id?1019041VDB EntryX Refsource SECTRACK
www.redhat.com/support/errata/RHSA-2007-1090.htmlVendor AdvisoryX Refsource REDHAT
secunia.com/advisories/27931Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.openoffice.org/security/cves/CVE-2007-4575.htmlX Refsource CONFIRMPatchVendor AdvisoryARTICLE
www.redhat.com/archives/fedora-package-announce/2007-December/msg00281.htmlVendor AdvisoryX Refsource FEDORA
www.redhat.com/support/errata/RHSA-2008-0158.htmlVendor AdvisoryX Refsource REDHAT
www.redhat.com/archives/fedora-package-announce/2008-January/msg00678.htmlVendor AdvisoryX Refsource FEDORA
www.redhat.com/archives/fedora-package-announce/2007-December/msg00134.htmlVendor AdvisoryX Refsource FEDORA
www.redhat.com/support/errata/RHSA-2007-1048.htmlVendor AdvisoryX Refsource REDHAT
www.ubuntu.com/usn/usn-609-1Vendor AdvisoryX Refsource UBUNTU
sunsolve.sun.com/search/document.do?assetkey=1-26-103141-1Vendor AdvisoryX Refsource SUNALERT
www.redhat.com/archives/fedora-package-announce/2007-December/msg00155.htmlVendor AdvisoryX Refsource FEDORA
access.redhat.com/errata/RHSA-2007:1090Advisory
access.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=299801REPORT
security.access.redhat.com/data/csaf/v2/advisories/2007/rhsa-2007_1090.jsonAdvisory
access.redhat.com/security/cve/CVE-2007-4575REPORT
www.cve.org/CVERecord?id=CVE-2007-4575Advisory
nvd.nist.gov/vuln/detail/CVE-2007-4575Advisory
security-tracker.debian.org/tracker/CVE-2007-4575Advisory