CVE-2010-2935

simpress.bin in the Impress module in OpenOffice.org (OOo) 2.x and 3.x before 3.3 does not properly handle integer values associated with dictionary property items, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PowerPoint document that triggers a heap-based buffer overflow, related to an "integer truncation error."

• CWE-189

• http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html
• http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00006.html
• http://secunia.com/advisories/40775Vendor Advisory
• http://secunia.com/advisories/41052Vendor Advisory
• http://secunia.com/advisories/41235
• http://secunia.com/advisories/42927
• http://secunia.com/advisories/43105
• http://secunia.com/advisories/60799
• http://securityevaluators.com/files/papers/CrashAnalysis.pdf
• http://ubuntu.com/usn/usn-1056-1
• http://www.debian.org/security/2010/dsa-2099
• http://www.gentoo.org/security/en/glsa/glsa-201408-19.xml
• http://www.mandriva.com/security/advisories?name=MDVSA-2010:221
• http://www.openoffice.org/security/cves/CVE-2010-2935_CVE-2010-2936.html
• http://www.openoffice.org/servlets/ReadMsg?list=dev&msgNo=27690
• http://www.openwall.com/lists/oss-security/2010/08/11/1
• http://www.openwall.com/lists/oss-security/2010/08/11/4
• http://www.oracle.com/technetwork/topics/security/cpujan2011-194091.html
• http://www.redhat.com/support/errata/RHSA-2010-0643.html
• http://www.securitytracker.com/id?1024352
• http://www.securitytracker.com/id?1024976
• http://www.vupen.com/english/advisories/2010/2003Vendor Advisory
• http://www.vupen.com/english/advisories/2010/2149Vendor Advisory
• http://www.vupen.com/english/advisories/2010/2228
• http://www.vupen.com/english/advisories/2010/2905
• http://www.vupen.com/english/advisories/2011/0150
• http://www.vupen.com/english/advisories/2011/0230
• http://www.vupen.com/english/advisories/2011/0279
• https://bugzilla.redhat.com/show_bug.cgi?id=622529
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12063
• http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html
• http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00006.html
• http://secunia.com/advisories/40775Vendor Advisory
• http://secunia.com/advisories/41052Vendor Advisory
• http://secunia.com/advisories/41235
• http://secunia.com/advisories/42927
• http://secunia.com/advisories/43105
• http://secunia.com/advisories/60799
• http://securityevaluators.com/files/papers/CrashAnalysis.pdf
• http://ubuntu.com/usn/usn-1056-1
• http://www.debian.org/security/2010/dsa-2099
• http://www.gentoo.org/security/en/glsa/glsa-201408-19.xml
• http://www.mandriva.com/security/advisories?name=MDVSA-2010:221
• http://www.openoffice.org/security/cves/CVE-2010-2935_CVE-2010-2936.html
• http://www.openoffice.org/servlets/ReadMsg?list=dev&msgNo=27690
• http://www.openwall.com/lists/oss-security/2010/08/11/1
• http://www.openwall.com/lists/oss-security/2010/08/11/4
• http://www.oracle.com/technetwork/topics/security/cpujan2011-194091.html
• http://www.redhat.com/support/errata/RHSA-2010-0643.html
• http://www.securitytracker.com/id?1024352
• http://www.securitytracker.com/id?1024976
• http://www.vupen.com/english/advisories/2010/2003Vendor Advisory
• http://www.vupen.com/english/advisories/2010/2149Vendor Advisory
• http://www.vupen.com/english/advisories/2010/2228
• http://www.vupen.com/english/advisories/2010/2905
• http://www.vupen.com/english/advisories/2011/0150
• http://www.vupen.com/english/advisories/2011/0230
• http://www.vupen.com/english/advisories/2011/0279
• https://bugzilla.redhat.com/show_bug.cgi?id=622529
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12063

Published

Aug 25, 2010

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2010-2929Untrusted search path vulnerability in hsolinkcontrol in hso…
• CVE-2010-2930Multiple stack-based buffer overflows in hsolinkcontrol in h…
• CVE-2010-2931Stack-based buffer overflow in SigPlus Pro 3.74 ActiveX cont…
• CVE-2010-2932Buffer overflow in BarCodeWiz BarCode 3.29 ActiveX control (…
• CVE-2010-2933SQL injection vulnerability in AV Scripts AV Arcade 3 allows…
• CVE-2010-2934Multiple unspecified vulnerabilities in ZNC 0.092 allow remo…
• CVE-2010-2936Integer overflow in simpress.bin in the Impress module in Op…
• CVE-2010-2937The ReadMetaFromId3v2 function in taglib.cpp in the TagLib p…
• CVE-2010-2938arch/x86/hvm/vmx/vmcs.c in the virtual-machine control struc…
• CVE-2010-2939Double free vulnerability in the ssl3_get_key_exchange funct…
• CVE-2010-2940The auth_send function in providers/ldap/ldap_auth.c in Syst…
• CVE-2010-2941ipp.c in cupsd in CUPS 1.4.4 and earlier does not properly a…9.8