Re: CVE Request -- OpenOffice.org -- InteVyDis Demo of OpenOffice 0day. Released with VulnDisco 8.8 pack (release date May,2009)

[Josh Bressers <bressers () redhat com>]

----- Original Message -----
> Hello, Josh, Steve, vendors,
>
> A new security flaw, potentially allowing execution of arbitrary code
> with the privileges of the user running the OpenOffice.org suite tools
> has been reported by the InteVyDis security researchers team:
> [1] http://intevydis.com/oo_0day.html
> [2] http://twitter.com/#!/legerov/status/75482755194032128
>
> References:
> [3] https://bugzilla.redhat.com/show_bug.cgi?id=709705
>
> Unfortunately there doesn't seem to be further detailed information
> available right now. But from the Twitter post, looks this issue is
> still valid against OpenOffice.org v3.3.
>
> Hopefully Evgeny Legerov of InteVyDis security researchers team
> (Cc-ed)
> could provide further background information about this issue, i.e.
> if it is an old issue (like date of 2009 would suggest) and thus a CVE
> identifier has been already assigned to this issue or is this
> completely
> new issue (which did not get fixed from 2009 till now) and thus it
> requires a new CVE id.
>
> Evgeny, any further information you could provide here, to clear the CVE
> doubt is really appreciated.
>
> Once the CVE doubt cleared, could you allocate a CVE id for this issue?

I'd say this is plenty to give a CVE ID.

Use CVE-2011-2177

Thanks.

-- 
    JB