vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2021-33035

Buffer overflow from a crafted DBF file

HIGH
7.8
CVSS Score
Published: September 23, 2021 at 08:10 AM UTC
Updated: June 17, 2026 at 03:54 AM UTC
1 product affected across 1 vendorOpenoffice

Using Apache OpenOffice by Apache Software Foundation?

Get instant alerts when new vulnerabilities affect Apache OpenOffice - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH7.8
Exploit prediction
EPSS 51%

Description

Apache OpenOffice opens dBase/DBF documents and shows the contents as spreadsheets. DBF are database files with data organized in fields. When reading DBF data the size of certain fields is not checked: the data is just copied into local variables. A carefully crafted document could overflow the allocated space, leading to the execution of arbitrary code by altering the contents of the program stack. This issue affects Apache OpenOffice up to and including version 4.1.10

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Openoffice· Apache
95%
v ≤ 4.1.10Apache OpenOffice ≤ v ≤ 4.1.10OpenOffice.org ≤ v ≤ 3.4OpenOffice.org

References (4)

Mailing Listx_refsource_MLISTPatchThird Party Advisory
Source: [email protected]
http://www.openwall.com/lists/oss-security/2021/10/07/3
x_refsource_MISCPatchThird Party Advisory
Source: [email protected]
https://github.com/apache/openoffice/commit/efddaef0151af3be16078cc4d88c6bae0f911e56#diff-ea66e734dd358922aba12ad4ba39c96bdc6cbde587d07dbc63d04daa0a30e90f
Mailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/r1ab8532e11f41bc7ca057ac7e39cab25f2e1f9d5f4929788ae21c8b9%40%3Cusers.openoffice.apache.org%3E
Mailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/r929c0c6a53cad64a1007b878342756badbb05ddd9b8f31a6d0b424cb%40%3Cannounce.apache.org%3E

CVSS

7.8HIGH[email protected]
Attack Vector
LOCAL
Complexity
LOW
Privileges
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-120

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card