soffice in OpenOffice.org (OOo) 3.x before 3.3 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.

soffice in OpenOffice.org (OOo) 3.x before 3.3 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.

OpenOffice.org: directory traversal flaws in handling of XSLT jar filter descriptions and OXT extension files OpenOffice.org: Array index error by insecure parsing of broken rtf tables OpenOffice.org: Integer signedness error (crash) by processing certain RTF tags OpenOffice.org: Heap-based buffer overflow by processing *.doc files with WW8 list styles with specially-crafted count of list levels OpenOffice.org: Array index error by scanning document typography information of certain *.doc files OpenOffice.org: soffice insecure LD_LIBRARY_PATH setting OpenOffice.org: heap based buffer overflow in PPT import OpenOffice.org: heap based buffer overflow when parsing TGA files