CVE-2021-33035: apache software foundation apache openoffice Classic Buffer Overflow
Vulnerability summary
CVE-2021-33035 is a high (CVSS 7.8) Classic Buffer Overflow vulnerability in apache software foundation apache openoffice. EPSS estimates a 50.56% chance of exploitation in the next 30 days, higher than 98.9% of scored vulnerabilities.
Timeline
- 23-09-2021PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
Apache OpenOffice opens dBase/DBF documents and shows the contents as spreadsheets. DBF are database files with data organized in fields. When reading DBF data the size of certain fields is not checked: the data is just copied into local variables. A carefully crafted document could overflow the allocated space, leading to the execution of arbitrary code by altering the contents of the program stack. This issue affects Apache OpenOffice up to and including version 4.1.10
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
50.56%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
0.00 pp
From 50.56% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Apache1 product
- openoffice≤ 4.1.10
Apache software foundation1 product
- apache openoffice≥ Apache OpenOffice, ≤ 4.1.10 | ≥ OpenOffice.org, ≤ 3.4
Debian1 product
- libreoffice< 1:4.3.1-1
Ubuntu1 product
- libreoffice< 1:6.0.7-0ubuntu0.18.04.10
4 vendors · 4 products
References
7 links- github.com/apache/openoffice/commit/efddaef0151af3be16078cc4d88c6bae0f911e56X Refsource MISCPatchThird Party Advisory
- www.openwall.com/lists/oss-security/2021/10/07/3Mailing ListX Refsource MLISTPatchThird Party Advisory
