[ MDVSA-2010:056 ] openoffice.org

Mandrivan turvallisuustiedotteiden tuoreimmat

[ MDVSA-2010:056 ] openoffice.org

Uusi viestiKirjoittaja dude67 » 20 Maalis 2010, 20:42

_______________________________________________________________________

Package : openoffice.org
Date : March 5, 2010
Affected: 2008.0
_______________________________________________________________________

Problem Description:

This update provides the OpenOffice.org 3.0 major version and holds
the security fixes for the following issues:

An integer underflow might allow remote attackers to execute arbitrary
code via crafted records in the document table of a Word document
leading to a heap-based buffer overflow (CVE-2009-0200).

An heap-based buffer overflow might allow remote attackers to execute
arbitrary code via unspecified records in a crafted Word document
related to table parsing. (CVE-2009-0201).

Multiple heap-based buffer overflows allow remote attackers to execute
arbitrary code via a crafted EMF+ file (CVE-2009-2140).

OpenOffice's xmlsec uses a bundled Libtool which might load .la
file in the current working directory allowing local users to gain
privileges via a Trojan horse file. For enabling such vulnerability
xmlsec has to use --enable-crypto_dl building flag however it does
not, although the fix keeps protected against this threat whenever
that flag had been enabled (CVE-2009-3736).

Additional packages are also being provided due to dependencies.

Packages for 2008.0 are provided for Corporate Desktop 2008.0
customers.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cg ... -2009-0200
http://cve.mitre.org/cgi-bin/cvename.cg ... -2009-0201
http://cve.mitre.org/cgi-bin/cvename.cg ... -2009-2140
http://cve.mitre.org/cgi-bin/cvename.cg ... -2009-3736
_______________________________________________________________________
Kuva
1. Mageia-1 KDE4 x86_64 (& Win7 Pro) | desktop
2. Mageia-2 KDE4 (& Win7 Home Premium) | laptop Acer 7530
3. Mageia-1 KDE4 (& Win7 Starter) | Samsung NC-10 miniläppäri
4. Mageia-1 KDE4 | serverinä toimiva desktop
Luotettavaa Linux käyttöä jo Mandriva 2006.0:sta lähtien :)
Avatar
dude67
Site Admin
 
Viestit: 2256
Liittynyt: 27 Syys 2007, 16:58
Paikkakunta: Espoo

Paluu Mandrivan turvallisuustiedotteet

Paikallaolijat

Käyttäjiä lukemassa tätä aluetta: Ei rekisteröityneitä käyttäjiä ja 17 vierailijaa

cron