QwikSec

Security Database

CVE

CWE

Training

CVE-2021-28129

Published: Oct 7, 2021

Modified: Aug 3, 2024

PUBLISHED

Description

While working on Apache OpenOffice 4.1.8 a developer discovered that the DEB package did not install using root, but instead used a userid and groupid of 500. This both caused issues with desktop integration and could allow a crafted attack on files owned by that user or group if they exist. Users who installed the Apache OpenOffice 4.1.8 DEB packaging should upgrade to the latest version of Apache OpenOffice.

Vendor	Product	Versions
Apache Software Foundation	Apache OpenOffice	affected `Apache OpenOffice 4.1.8`

Weaknesses (CWE)

References

https://lists.apache.org/thread.html/rc9090ab48b4699494b63b35cd6d7414c52d665ecae12add3cdc56c9b%40%3Cusers.openoffice.apache.org%3E

x_refsource_MISC

[announce] 20211007 CVE-2021-28129: DEB packaging for Apache OpenOffice 4.1.8 installed with a non-root userid and groupid

mailing-list

x_refsource_MLIST

[openoffice-users] 20211007 CVE-2021-28129: DEB packaging for Apache OpenOffice 4.1.8 installed with a non-root userid and groupid

mailing-list

x_refsource_MLIST

[oss-security] 20211007 CVE-2021-28129: DEB packaging for Apache OpenOffice 4.1.8 installed with a non-root userid and groupid

mailing-list

x_refsource_MLIST

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.