CVE-2010-0136

CriticalCVSS 9.3/10Last modified Jun 16, 2026

Description

OpenOffice.org (OOo) 2.0.4, 2.4.1, and 3.1.1 does not properly enforce Visual Basic for Applications (VBA) macro security settings, which allows remote attackers to run arbitrary macros via a crafted document.

Metrics

CVSS 2.0 9.3/10AV:N/AC:M/Au:N/C:C/I:C/A:C

Weakness enumeration

CWE-77

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00005.htmlThird Party Advisory
http://secunia.com/advisories/38695Broken Link
http://secunia.com/advisories/38921Broken Link
http://securitytracker.com/id?1023588Broken Link, Third Party Advisory, VDB Entry
http://www.debian.org/security/2010/dsa-1995Third Party Advisory
http://www.mail-archive.com/debian-openoffice%40lists.debian.org/msg23178.html
http://www.mandriva.com/security/advisories?name=MDVSA-2010:221Broken Link
http://www.securityfocus.com/bid/38245Broken Link, Third Party Advisory, VDB Entry
http://www.ubuntu.com/usn/USN-903-1Third Party Advisory
http://www.vupen.com/english/advisories/2010/0635Broken Link
http://www.vupen.com/english/advisories/2010/2905Broken Link
http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00005.htmlThird Party Advisory
http://secunia.com/advisories/38695Broken Link
http://secunia.com/advisories/38921Broken Link
http://securitytracker.com/id?1023588Broken Link, Third Party Advisory, VDB Entry
http://www.debian.org/security/2010/dsa-1995Third Party Advisory
http://www.mail-archive.com/debian-openoffice%40lists.debian.org/msg23178.html
http://www.mandriva.com/security/advisories?name=MDVSA-2010:221Broken Link
http://www.securityfocus.com/bid/38245Broken Link, Third Party Advisory, VDB Entry
http://www.ubuntu.com/usn/USN-903-1Third Party Advisory
http://www.vupen.com/english/advisories/2010/0635Broken Link
http://www.vupen.com/english/advisories/2010/2905Broken Link

Timeline

Published: Feb 16, 2010
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2010

CVE-2010-01377.8Unspecified vulnerability in the sshd_child_handler process in the SSH server in Cisco IOS XR 3.4.1 through 3.7.0 allows remote attackers to CVE-2010-013810.0Buffer overflow in Cisco CiscoWorks Internetwork Performance Monitor (IPM) 2.6 and earlier on Windows, as distributed in CiscoWorks LAN Mana CVE-2010-01399.0Cisco Unified MeetingPlace 7 before 7.0(2.3) hotfix 5F, 6 before 6.0.639.2, and possibly 5 does not properly validate SQL commands, which al CVE-2010-014010.0Multiple unspecified vulnerabilities in the web server in Cisco Unified MeetingPlace 7 before 7.0(2.3) hotfix 5F, 6 before 6.0.639.3, and po CVE-2010-01416.4MeetingTime in Cisco Unified MeetingPlace 6 before MR5, and possibly 5, allows remote attackers to discover usernames, passwords, and unspec CVE-2010-01428.5MeetingTime in Cisco Unified MeetingPlace 6 before MR5, and possibly 5, allows remote authenticated users to gain privileges via a modified CVE-2010-01437.8Unspecified vulnerability in the administrative interface in the embedded HTTPS server on the Cisco IronPort Encryption Appliance 6.2.x befo CVE-2010-01447.8Unspecified vulnerability in the WebSafe DistributorServlet in the embedded HTTPS server on the Cisco IronPort Encryption Appliance 6.2.x be CVE-2010-014510.0Unspecified vulnerability in the embedded HTTPS server on the Cisco IronPort Encryption Appliance 6.2.x before 6.2.9.1 and 6.5.x before 6.5.CVE-2010-01466.8Directory traversal vulnerability in the Management Center for Cisco Security Agents 6.0 allows remote authenticated users to read arbitrary CVE-2010-01476.5SQL injection vulnerability in the Management Center for Cisco Security Agents 5.1 before 5.1.0.117, 5.2 before 5.2.0.296, and 6.0 before 6.CVE-2010-01487.8Unspecified vulnerability in Cisco Security Agent 5.2 before 5.2.0.285, when running on Linux, allows remote attackers to cause a denial of