Fedora alert FEDORA-2011-0837 (openoffice.org)
| From: | updates@fedoraproject.org | |
| To: | package-announce@lists.fedoraproject.org | |
| Subject: | [SECURITY] Fedora 13 Update: openoffice.org-3.2.0-12.35.fc13 | |
| Date: | Thu, 17 Feb 2011 00:50:23 +0000 | |
| Message-ID: | <20110217005023.1B04A110A5E@bastion02.phx2.fedoraproject.org> | |
| Archive‑link: | Article |
-------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2011-0837 2011-01-27 20:28:08 -------------------------------------------------------------------------------- Name : openoffice.org Product : Fedora 13 Version : 3.2.0 Release : 12.35.fc13 URL : http://www.openoffice.org/ Summary : OpenOffice.org comprehensive office suite Description : OpenOffice.org is an Open Source, community-developed, multi-platform office productivity suite. It includes the key desktop applications, such as a word processor, spreadsheet, presentation manager, formula editor and drawing program, with a user interface and feature set similar to other office suites. Sophisticated and flexible, OpenOffice.org also works transparently with a variety of file formats, including Microsoft Office. Usage: Simply type "ooffice" to run OpenOffice.org or select the requested component (Writer, Calc, Impress, etc.) from your desktop menu. On first start a few files will be installed in the user's home, if necessary. -------------------------------------------------------------------------------- ChangeLog: * Thu Jan 27 2011 Caolán McNamara <caolanm@redhat.com>- 1:3.2.0-12.35 - CVE-2010-3450 Extensions and filter package files - CVE-2010-3451 / CVE-2010-3452 RTF documents - CVE-2010-3453 / CVE-2010-3454 Word documents - CVE-2010-3689 LD_LIBRARY_PATH usage - CVE-2010-4253 PNG graphics - CVE-2010-4643 TGA graphics - Resolves: rhbz#648475 Crash in scanner dialog - Resolves: rhbz#657628 divide-by-zero - Resolves: rhbz#657718 Crash in SwObjectFormatterTxtFrm - Resolves: rhbz#660312 SDK setup script creates invalid variables (dtardon) - Resolves: rhbz#663780 extend neon mutex locking - Resoves: rhbz#577525 [abrt] crash in ImplRegionBase::~ImplRegionBase (dtardon) * Tue Oct 26 2010 Caolán McNamara <caolanm@redhat.com> - 1:3.2.0-12.34 - Resolves: rhbz#636521 crash in undo in sc - Resolves: rhbz#641637 [abrt] [presentation-minimizer] crash in OptimizationStats::GetStatusValue (dtardon) - make LD_PRELOAD of libsalalloc_malloc.so work again (dtardon) - Resolves: rhbz#642996 [abrt] CffSubsetterContext::readDictOp (dtardon) * Fri Oct 15 2010 Caolán McNamara <caolanm@redhat.com> - 1:3.2.0-12.33 - Resolves: rhbz#637838 Cropped pictures are displayed in entirety in handouts (dtardon) * Tue Oct 12 2010 Caolán McNamara <caolanm@redhat.com> - 1:3.2.0-12.32 - Resolves: rhbz#568277 workaround to avoid the crash (dtardon) - Resolves: rhbz#631543 [abrt] crash on dereferencing dangling pointer passed down from SwCalc::Str2Double (dtardon) - Resolves: rhbz#631823 Line and Filling toolbar glitch on theme change (caolanm) - Resolves: rhbz#637738 threading problems with using libgcrypt via neon when libgcrypt which was initialized by cups to be non-thread safe (caolanm) - Resolves: rhbz#632326 [abrt] [docx] _Construct<long, long> crash (dtardon) * Fri Aug 13 2010 Caolán McNamara <caolanm@redhat.com> - 1:3.2.0-12.31 - Resolves: rhbz#623800 gnome-shell/mutter focus problems * Thu Aug 12 2010 Caolán McNamara <caolanm@redhat.com> - 1:3.2.0-12.30 - Resolves: rhbz#623609 CVE-2010-2935 CVE-2010-2936 * Mon Aug 9 2010 Caolán McNamara <caolanm@redhat.com> - 1:3.2.0-12.29 - Resolves: rhbz#601621 avoid using mmap for copying files * Sun Aug 8 2010 Caolán McNamara <caolanm@redhat.com> - 1:3.2.0-12.28 - Resolves: rhbz#621248 32bit events in forms on 64bit - Resolves rhbz#618047 Brackets incorrectly render in presentations (dtardon) * Wed Aug 4 2010 Caolán McNamara <caolanm@redhat.com> - 1:3.2.0-12.27 - Resolves: rhbz#608114 cppu-lifecycle issues (caolanm) - Resolves: rhbz#566831 [abrt] crash in GetFrmSize (dtardon) - Resolves: rhbz#613278 [abrt] crash in SANE shutdown (caolanm) - Resolves: rhbz#620390 [abrt] crash in SfxViewFrame::GetFrame (dtardon) * Mon Jun 21 2010 Caolán McNamara <caolanm@redhat.com> - 1:3.2.0-12.26 - Resolves: rhbz#606021 openoffice.org-3.3.0.ooo112567.vcl.embeddedbitmaps.patch * Fri Jun 18 2010 Caolán McNamara <caolanm@redhat.com> - 1:3.2.0-12.25 - Resolves: rhbz#602631 dual head fixes add workspace.ooo321gsl05.patch - Resolves: rhbz#603298 crash in ImplFontCharMap::GetGlyphIndex - Resolves: rhbz#601890/ooo#112384 avoid crash on export to .doc - Resolves: rhbz#603043/ooo#112386 improve gtk fpicker stability - Resolves: rhbz#605594 openoffice.org-3.3.0.ooo112516.sw.avoid.divbyzero.patch - Resolves: rhbz#604850 openoffice.org-3.3.0.ooo107490.cppu.lifecycle.patch * Sat Jun 5 2010 Caolán McNamara <caolanm@redhat.com> - 1:3.2.0-12.24 - Resolves: CVE-2010-0395 openoffice.org-3.2.1.pyuno.patch - Resolves: rhbz#596807 openoffice.org-3.2.0.ooo111886.sw.layout.workaround.patch - Protect against broken samba servers (caolanm) - Resolves: rhbz#597820 workspace.sw321bf01.patch (dtardon) - Resolves: rhbz#598052 workspace.cmcfixes75.patch (caolanm) - Resolves: rhbz#598582 openoffice.org-3.2.1.ooo112027.writerfilter.avoid.recursetodeath.patch (caolanm) - Resolves: rhbz#599287 openoffice.org-3.3.0.ooo112059.sw.avoid-null-ptr-deref.patch (dtardon) - Resolves: rhbz#599585 workspace.os140.patch (dtardon) - Resolves: rhbz#596980 workspace.vcl112.patch (caolanm) * Fri May 21 2010 Caolán McNamara <caolanm@redhat.com> - 1:3.2.0-12.23 - Resolves: rhbz#594035 openoffice.org-3.3.0.ooo111758.sd.xerror.patch * Wed May 19 2010 Caolán McNamara <caolanm@redhat.com> - 1:3.2.0-12.22 - Resolves: rhbz#593561 openoffice.org-3.3.0.ooo111699.svx.nullfield.patch * Fri May 7 2010 Caolán McNamara <caolanm@redhat.com> - 1:3.2.0-12.21 - Resolves: rhbz#589861 [abrt] crash in DomainMapper_Impl::finishParagraph - Resolves: rhbz#589889 don't require exact zh fonts * Thu May 6 2010 Caolán McNamara <caolanm@redhat.com> - 1:3.2.0-12.20 - Related: rhbz#587419 copy attributes correctly (dtardon) * Fri Apr 30 2010 Caolán McNamara <caolanm@redhat.com> - 1:3.2.0-12.19 - Resolves: rhbz#587419 [abrt] crash in SwTxtFtn::CopyFtn (dtardon) * Wed Apr 28 2010 Caolán McNamara <caolanm@redhat.com> - 1:3.2.0-12.18 - Resolves: rhbz#586446 openoffice.org-3.3.0.ooo93818.sw.postitprint.patch - add openoffice.org-3.2.0.ooo101131.sw.size.mismatch.patch * Sun Apr 25 2010 Caolán McNamara <caolanm@redhat.com> - 1:3.2.0-12.17 - Resolves: rhbz#583386 docx import crash -------------------------------------------------------------------------------- References: [ 1 ] Bug #602324 - CVE-2010-3450 OpenOffice.org: directory traversal flaws in handling of XSLT jar filter descriptions and OXT extension files https://bugzilla.redhat.com/show_bug.cgi?id=602324 [ 2 ] Bug #641282 - CVE-2010-3451 OpenOffice.org: Array index error by insecure parsing of broken rtf tables https://bugzilla.redhat.com/show_bug.cgi?id=641282 [ 3 ] Bug #640241 - CVE-2010-3452 OpenOffice.org: Integer signedness error (crash) by processing certain RTF tags https://bugzilla.redhat.com/show_bug.cgi?id=640241 [ 4 ] Bug #640950 - CVE-2010-3453 OpenOffice.org: Heap-based buffer overflow by processing *.doc files with WW8 list styles with specially-crafted count of list levels https://bugzilla.redhat.com/show_bug.cgi?id=640950 [ 5 ] Bug #640954 - CVE-2010-3454 OpenOffice.org: Array index error by scanning document typography information of certain *.doc files https://bugzilla.redhat.com/show_bug.cgi?id=640954 [ 6 ] Bug #641224 - CVE-2010-3689 OpenOffice.org: soffice insecure LD_LIBRARY_PATH setting https://bugzilla.redhat.com/show_bug.cgi?id=641224 [ 7 ] Bug #658259 - CVE-2010-4253 OpenOffice.org: heap based buffer overflow in PPT import https://bugzilla.redhat.com/show_bug.cgi?id=658259 [ 8 ] Bug #667588 - CVE-2010-4643 OpenOffice.org: heap based buffer overflow when parsing TGA files https://bugzilla.redhat.com/show_bug.cgi?id=667588 -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update openoffice.org' at the command line. For more information, refer to "Managing Software with yum", available at http://docs.fedoraproject.org/yum/. All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list package-announce@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/package-...