CVE-2007-4575

29

FAUCET Score

CVE-2007-4575 describes a critical vulnerability in HSQLDB versions prior to 1.8.0.9, specifically as integrated into OpenOffice.org 2 before 2.3.1. This flaw allows user-assisted remote attackers to execute arbitrary Java code by crafting malicious database documents, leveraging the exposure of static Java methods. With a CVSS score of 9.3, it presents a high risk due to its network-based attack vector, medium complexity, and complete compromise of confidentiality, integrity, and availability. Despite its severity, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		<= 2.3CPE matchmatch criteria	cpe:2.3:a:openoffice:openoffice::::::::
		2.0.1CPE matchmatch criteria	cpe:2.3:a:openoffice:openoffice:2.0.1:::::::*
		2.0.2CPE matchmatch criteria	cpe:2.3:a:openoffice:openoffice:2.0.2:::::::*
		2.0.3CPE matchmatch criteria	cpe:2.3:a:openoffice:openoffice:2.0.3:::::::*
		2.0.3_1CPE matchmatch criteria	cpe:2.3:a:openoffice:openoffice:2.0.3_1:::::::*

CVSS Data

CVSS version used by this source: 2.0

9.3HIGH

AV:N/AC:M/Au:N/C:C/I:C/A:C

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Exploitability Score

8.6

Impact Score

10.0

CvssVersion

2.0

Exploit Intelligence

EPSS Score

14.35%

Probability of exploitation in next 30 days

EPSS Percentile

96.2%

Percentile rank of EPSS score among Peer Group

As of 2026-07-24

Model: v2026.06.15

This CVE's current EPSS score of 0.1435 is in the 80th percentile among its peer group of 8,914 CVEs.

Social Chatter

No social media mentions found for this CVE.

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (60)

denopatch availablevia llm_extracted

Fixed in: 2.3.1

libreofficepatch availablevia llm_extracted

Fixed in: 2.3.1

nessuspatch availablevia llm_extracted

Fixed in: 2.3.1

postgresqlpatch availablevia llm_extracted

Fixed in: 2.3.1

redhatpatch availablevia redhat_api

Product: JBEAP 4.2.0 for RHEL 4Fixed in: hsqldb-1:1.8.0.8-2.patch01.1jpp.ep1.1

redhatpatch availablevia redhat_api

Product: JBEAP 4.2.0 for RHEL 4Fixed in: jacorb-0:2.3.0-1jpp.ep1.4

redhatpatch availablevia redhat_api

Product: JBEAP 4.2.0 for RHEL 4Fixed in: jboss-aop-0:1.5.5-1.CP01.0jpp.ep1.1.el4

redhatpatch availablevia redhat_api

Product: JBEAP 4.2.0 for RHEL 4Fixed in: jbossas-0:4.2.0-3.GA_CP02.ep1.3.el4

redhatpatch availablevia redhat_api

Product: JBEAP 4.2.0 for RHEL 4Fixed in: jboss-cache-0:1.4.1-4.SP8_CP01.1jpp.ep1.1.el4

redhatpatch availablevia redhat_api

Product: JBEAP 4.2.0 for RHEL 4Fixed in: jboss-remoting-0:2.2.2-3.SP4.0jpp.ep1.1

redhatpatch availablevia redhat_api

Product: JBEAP 4.2.0 for RHEL 4Fixed in: jboss-seam-0:1.2.1-1.ep1.3.el4

redhatpatch availablevia redhat_api

Product: JBEAP 4.2.0 for RHEL 4Fixed in: jbossweb-0:2.0.0-3.CP05.0jpp.ep1.1

redhatpatch availablevia redhat_api

Product: JBEAP 4.2.0 for RHEL 4Fixed in: jbossws-jboss42-0:1.2.1-0jpp.ep1.2.el4

redhatpatch availablevia redhat_api

Product: JBEAP 4.2.0 for RHEL 4Fixed in: jcommon-0:1.0.12-1jpp.ep1.2.el4

redhatpatch availablevia redhat_api

Product: JBEAP 4.2.0 for RHEL 4Fixed in: jfreechart-0:1.0.9-1jpp.ep1.2.el4

redhatpatch availablevia redhat_api

Product: JBEAP 4.2.0 for RHEL 4Fixed in: jgroups-1:2.4.1-1.SP4.0jpp.ep1.2

redhatpatch availablevia redhat_api

Product: JBEAP 4.2.0 for RHEL 4Fixed in: rh-eap-docs-0:4.2.0-3.GA_CP02.ep1.1.el4

redhatpatch availablevia redhat_api

Product: JBEAP 4.2.0 for RHEL 5Fixed in: hibernate3-0:3.2.4-1.SP1_CP02.0jpp.ep1.1.el5.1

redhatpatch availablevia redhat_api

Product: JBEAP 4.2.0 for RHEL 5Fixed in: hibernate3-annotations-0:3.2.1-1.patch02.1jpp.ep1.2.el5.1

redhatpatch availablevia redhat_api

Product: JBEAP 4.2.0 for RHEL 5Fixed in: jacorb-0:2.3.0-1jpp.ep1.5.el5

redhatpatch availablevia redhat_api

Product: JBEAP 4.2.0 for RHEL 5Fixed in: jboss-aop-0:1.5.5-1.CP01.0jpp.ep1.1.el5

redhatpatch availablevia redhat_api

Product: JBEAP 4.2.0 for RHEL 5Fixed in: jbossas-0:4.2.0-4.GA_CP02.ep1.3.el5.3

redhatpatch availablevia redhat_api

Product: JBEAP 4.2.0 for RHEL 5Fixed in: jboss-cache-0:1.4.1-4.SP8_CP01.1jpp.ep1.1.el5

redhatpatch availablevia redhat_api

Product: JBEAP 4.2.0 for RHEL 5Fixed in: jboss-remoting-0:2.2.2-3.SP4.0jpp.ep1.1.el5

redhatpatch availablevia redhat_api

Product: JBEAP 4.2.0 for RHEL 5Fixed in: jboss-seam-0:1.2.1-1.ep1.3.el5

redhatpatch availablevia redhat_api

Product: JBEAP 4.2.0 for RHEL 5Fixed in: jbossweb-0:2.0.0-3.CP05.0jpp.ep1.1.el5

redhatpatch availablevia redhat_api

Product: JBEAP 4.2.0 for RHEL 5Fixed in: jcommon-0:1.0.12-1jpp.ep1.2.el5

redhatpatch availablevia redhat_api

Product: JBEAP 4.2.0 for RHEL 5Fixed in: jfreechart-0:1.0.9-1jpp.ep1.2.el5.1

redhatpatch availablevia redhat_api

Product: JBEAP 4.2.0 for RHEL 5Fixed in: rh-eap-docs-0:4.2.0-3.GA_CP02.ep1.1.el5.1

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 4Fixed in: openoffice.org2-1:2.0.4-5.7.0.3.0

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 5Fixed in: hsqldb-1:1.8.0.4-3jpp.6

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 5Fixed in: openoffice.org-1:2.0.4-5.4.25

redhatpatch availablevia redhat_api

Product: Red Hat Web Application Stack for RHEL 4Fixed in: concurrent-0:1.3.4-7jpp.ep1.6.el4

redhatpatch availablevia redhat_api

Product: Red Hat Web Application Stack for RHEL 4Fixed in: glassfish-jaf-0:1.1.0-0jpp.ep1.10.el4

redhatpatch availablevia redhat_api

Product: Red Hat Web Application Stack for RHEL 4Fixed in: glassfish-javamail-0:1.4.0-0jpp.ep1.8

redhatpatch availablevia redhat_api

Product: Red Hat Web Application Stack for RHEL 4Fixed in: glassfish-jsf-0:1.2_04-1.p02.0jpp.ep1.18

redhatpatch availablevia redhat_api

Product: Red Hat Web Application Stack for RHEL 4Fixed in: glassfish-jstl-0:1.2.0-0jpp.ep1.2

redhatpatch availablevia redhat_api

Product: Red Hat Web Application Stack for RHEL 4Fixed in: hibernate3-1:3.2.4-1.SP1_CP02.0jpp.ep1.1.el4

redhatpatch availablevia redhat_api

Product: Red Hat Web Application Stack for RHEL 4Fixed in: hibernate3-annotations-0:3.2.1-1.patch02.1jpp.ep1.2.el4

redhatpatch availablevia redhat_api

Product: Red Hat Web Application Stack for RHEL 4Fixed in: hibernate3-entitymanager-0:3.2.1-1jpp.ep1.6.el4

redhatpatch availablevia redhat_api

Product: Red Hat Web Application Stack for RHEL 4Fixed in: hsqldb-1:1.8.0.8-2.patch01.1jpp.ep1.1

redhatpatch availablevia redhat_api

Product: Red Hat Web Application Stack for RHEL 4Fixed in: jacorb-0:2.3.0-1jpp.ep1.4

redhatpatch availablevia redhat_api

Product: Red Hat Web Application Stack for RHEL 4Fixed in: jboss-aop-0:1.5.5-1.CP01.0jpp.ep1.1.el4

redhatpatch availablevia redhat_api

Product: Red Hat Web Application Stack for RHEL 4Fixed in: jbossas-0:4.2.0-3.GA_CP02.ep1.3.el4

redhatpatch availablevia redhat_api

Product: Red Hat Web Application Stack for RHEL 4Fixed in: jboss-cache-0:1.4.1-4.SP8_CP01.1jpp.ep1.1.el4

redhatpatch availablevia redhat_api

Product: Red Hat Web Application Stack for RHEL 4Fixed in: jboss-common-0:1.2.1-0jpp.ep1.2

redhatpatch availablevia redhat_api

Product: Red Hat Web Application Stack for RHEL 4Fixed in: jboss-remoting-0:2.2.2-3.SP4.0jpp.ep1.1

redhatpatch availablevia redhat_api

Product: Red Hat Web Application Stack for RHEL 4Fixed in: jboss-seam-0:1.2.1-1.ep1.3.el4

redhatpatch availablevia redhat_api

Product: Red Hat Web Application Stack for RHEL 4Fixed in: jbossweb-0:2.0.0-3.CP05.0jpp.ep1.1

redhatpatch availablevia redhat_api

Product: Red Hat Web Application Stack for RHEL 4Fixed in: jbossws-wsconsume-impl-0:2.0.0-0jpp.ep1.3

redhatpatch availablevia redhat_api

Product: Red Hat Web Application Stack for RHEL 4Fixed in: jbossxb-0:1.0.0-2.SP1.0jpp.ep1.2.el4

redhatpatch availablevia redhat_api

Product: Red Hat Web Application Stack for RHEL 4Fixed in: jcommon-0:1.0.12-1jpp.ep1.2.el4

redhatpatch availablevia redhat_api

Product: JBEAP 4.2.0 for RHEL 4Fixed in: glassfish-javamail-0:1.4.0-0jpp.ep1.8

redhatpatch availablevia redhat_api

Product: Red Hat Web Application Stack for RHEL 4Fixed in: jgroups-1:2.4.1-1.SP4.0jpp.ep1.2

redhatpatch availablevia redhat_api

Product: Red Hat Web Application Stack for RHEL 4Fixed in: rh-eap-docs-0:4.2.0-3.GA_CP02.ep1.1.el4

redhatpatch availablevia redhat_api

Product: Red Hat Web Application Stack for RHEL 4Fixed in: wsdl4j-0:1.6.2-1jpp.ep1.8

redhatpatch availablevia redhat_api

Product: Red Hat Web Application Stack for RHEL 4Fixed in: jfreechart-0:1.0.9-1jpp.ep1.2.el4

redhatpatch availablevia redhat_api

Product: JBEAP 4.2.0 for RHEL 4Fixed in: hibernate3-1:3.2.4-1.SP1_CP02.0jpp.ep1.1.el4

redhatpatch availablevia redhat_api

Product: JBEAP 4.2.0 for RHEL 4Fixed in: hibernate3-annotations-0:3.2.1-1.patch02.1jpp.ep1.2.el4

redhatpatch availablevia redhat_api

Product: JBEAP 4.2.0 for RHEL 4Fixed in: hibernate3-entitymanager-0:3.2.1-1jpp.ep1.6.el4

Vendor Advisories (5)

redhatCVE-2007-4575Moderate

OpenOffice.org-base allows Denial-of-Service and command injection

denollm-deno-e6e193ff5090d7b5

Potential arbitrary code execution vulnerability in 3rd party module (HSQLDB)

postgresqlllm-postgresql-38b62bc2d8a731a4

Potential arbitrary code execution vulnerability in 3rd party module (HSQLDB)

libreofficellm-libreoffice-2ea2f41c401fca41

Potential arbitrary code execution vulnerability in 3rd party module (HSQLDB)

nessusllm-nessus-f05bbc3c9bab396e

Potential arbitrary code execution vulnerability in 3rd party module (HSQLDB)

References

bugs.gentoo.org / show_bug.cgi

bugs.gentoo.org / show_bug.cgi

lists.opensuse.org / opensuse-security-announce/2007-12/msg00005.html

secunia.com / advisories/27914

Vendor Advisory

secunia.com / advisories/27916

Vendor Advisory

secunia.com / advisories/27928

PatchVendor Advisory

secunia.com / advisories/27931

Vendor Advisory

secunia.com / advisories/27972

Vendor Advisory

secunia.com / advisories/28018

Vendor Advisory

secunia.com / advisories/28039

Vendor Advisory

secunia.com / advisories/28286

Vendor Advisory

secunia.com / advisories/28585

Vendor Advisory

secunia.com / advisories/30100

Vendor Advisory

exchange.xforce.ibmcloud.com / vulnerabilities/38882

oval.cisecurity.org / repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10153

sunsolve.sun.com / search/document.do

Vendor Advisory

sunsolve.sun.com / search/document.do

redhat.com / archives/fedora-package-announce/2008-January/msg00678.html

redhat.com / archives/fedora-package-announce/2008-January/msg00753.html

debian.org / security/2007/dsa-1419

gentoo.org / security/en/glsa/glsa-200712-25.xml

mandriva.com / security/advisories

openoffice.org / security/cves/CVE-2007-4575.html

PatchVendor Advisory

redhat.com / archives/fedora-package-announce/2007-December/msg00134.html

redhat.com / archives/fedora-package-announce/2007-December/msg00155.html

redhat.com / archives/fedora-package-announce/2007-December/msg00281.html

redhat.com / support/errata/RHSA-2007-1048.html

redhat.com / support/errata/RHSA-2007-1090.html

redhat.com / support/errata/RHSA-2008-0151.html

redhat.com / support/errata/RHSA-2008-0158.html

redhat.com / support/errata/RHSA-2008-0213.html

securityfocus.com / bid/26703

Patch

securitytracker.com / id

ubuntu.com / usn/usn-609-1

vupen.com / english/advisories/2007/4092

Vendor Advisory

vupen.com / english/advisories/2007/4146

Vendor Advisory