CVE-2010-0136: apache openoffice

Modified

Published 16-02-2010Last modified 07-08-2024

Vulnerability summary

CVE-2010-0136 is a high (CVSS 9.3) vulnerability in apache openoffice. EPSS estimates a 8.10% chance of exploitation in the next 30 days, higher than 94.8% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 9.3, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

9.3/10

010

High · v2.0 (NVD)

EPSS score

8.10%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1

DSA-1995-1

Timeline

16-02-2010
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

OpenOffice.org (OOo) 2.0.4, 2.4.1, and 3.1.1 does not properly enforce Visual Basic for Applications (VBA) macro security settings, which allows remote attackers to run arbitrary macros via a crafted document.

CVSS metrics

1 score · 1 source · 1 version

v2.09.3

EPSS trend

Probability

8.10%

Chance of exploitation in the next 30 days

Percentile

95%

Versus all other CVEs

30-day change

No change 0.00 pp

From 8.10% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-77Improper Neutralization of Special Elements used in a CommandThe product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Affected systems

Version check

Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.

Apache1 product

openoffice2.0.4 | 2.4.1 | 3.1.1

Canonical1 product

ubuntu_linuxEOL8.04 | 8.10 | 9.04 | 9.10

Debian1 product

debian_linuxEOL4.0 | 5.0

3 vendors · 3 products

References

11 links

www.mandriva.com/security/advisories?name=MDVSA-2010:221Vendor AdvisoryX Refsource MANDRIVABroken Link
secunia.com/advisories/38695Third Party AdvisoryX Refsource SECUNIABroken Link
www.debian.org/security/2010/dsa-1995Vendor AdvisoryX Refsource DEBIANThird Party Advisory
securitytracker.com/id?1023588VDB EntryX Refsource SECTRACKBroken LinkThird Party Advisory
www.ubuntu.com/usn/USN-903-1Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2010-03/msg00005.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
www.mail-archive.com/debian-openoffice%40lists.debian.org/msg23178.htmlMailing ListX Refsource MLIST
www.vupen.com/english/advisories/2010/0635VDB EntryX Refsource VUPENBroken Link
www.securityfocus.com/bid/38245VDB EntryX Refsource BIDBroken LinkThird Party Advisory
secunia.com/advisories/38921Third Party AdvisoryX Refsource SECUNIABroken Link

Show all 11 references

www.vupen.com/english/advisories/2010/2905VDB EntryX Refsource VUPENBroken Link