OpenOffice patches three security holes

The vulnerabilities affect OpenOffice versions 2 and 1.1.5

OpenOffice.org has released an update for its open source productivity suite that plugs three security vulnerabilities.

Security website Secunia rated the vulnerabilities as 'moderately critical', its third most severe designation on a five-step scale.

The first flaw is a vulnerability in the way that the suite handles Java applets, which could provide an attacker with full access to a system through a specially crafted Java application.

This could lead to data loss or disclosure of sensitive data, or cause additional security issues, Openoffice.org warned in a security advisory. 

A second vulnerability could allow an attacker to take control of a system by embedding basic code into a document. The code would be executed on loading the document without warning the user.

The last vulnerability could cause a buffer overflow through the use of a malformed XML document. The flaw could also allow an attacker to take control of a system.

OpenOffice.org credited a vulnerability researcher at NGS Software for discovering the XML vulnerability. 

The vulnerabilities affect OpenOffice versions 2 and 1.1.5. An update for version 2 is available for download now. A patch for the previous version will be released shortly.