Unscored severity · published Feb 16, 2010
CVE-2010-0136
OpenOffice.org (OOo) 2.0.4, 2.4.1, and 3.1.1 does not properly enforce Visual Basic for Applications (VBA) macro security settings, which allows remote attackers to run arbitrary…
–
CVSS
8.1%
EPSS
No
On KEV
Description
OpenOffice.org (OOo) 2.0.4, 2.4.1, and 3.1.1 does not properly enforce Visual Basic for Applications (VBA) macro security settings, which allows remote attackers to run arbitrary macros via a crafted document.
Exploitation
Is it being used?
Exploit prediction (EPSS)8.1% · higher than 95% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DL
Debian Linux · Debian
4.0; 5.0 · source: NVD
OP
Openoffice · Apache
2.0.4; 2.4.1; 3.1.1 · source: NVD
UL
Ubuntu Linux · Canonical
8.04; 8.10; 9.04; 9.10 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2010-0136
CVE.org
https://www.cve.org/CVERecord?id=CVE-2010-0136
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00005.html
Broken Link
http://secunia.com/advisories/38695
Broken Link
http://secunia.com/advisories/38921
Broken Link
http://securitytracker.com/id?1023588
Third Party Advisory
http://www.debian.org/security/2010/dsa-1995
www.mail-archive.com
http://www.mail-archive.com/debian-openoffice%40lists.debian.org/msg23178.html
More from Openoffice
8.8
CVE-2023-47804
Apache OpenOffice documents can contain links that call internal macros with arbitrary arguments
8.8
CVE-2022-37401
Apache OpenOffice supports the storage of passwords for web connections in the user's configuration database
8.8
CVE-2022-37400
Apache OpenOffice supports the storage of passwords for web connections in the user's configuration database
8.8
CVE-2021-30245
The project received a report that all versions of Apache OpenOffice through 4.1.8 can open non-http(s) hyperlinks
8.1
CVE-2025-64403
Apache OpenOffice Calc spreadsheet can contain links to other files, in the form of "external data sources"