[SECURITY] Fedora 13 Update: openoffice.org-3.2.0-12.35.fc13
updates at fedoraproject.org
updates at fedoraproject.org
Thu Feb 17 00:50:23 UTC 2011
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2011-0837
2011-01-27 20:28:08
--------------------------------------------------------------------------------
Name : openoffice.org
Product : Fedora 13
Version : 3.2.0
Release : 12.35.fc13
URL : http://www.openoffice.org/
Summary : OpenOffice.org comprehensive office suite
Description :
OpenOffice.org is an Open Source, community-developed, multi-platform
office productivity suite. It includes the key desktop applications,
such as a word processor, spreadsheet, presentation manager, formula
editor and drawing program, with a user interface and feature set
similar to other office suites. Sophisticated and flexible,
OpenOffice.org also works transparently with a variety of file
formats, including Microsoft Office.
Usage: Simply type "ooffice" to run OpenOffice.org or select the
requested component (Writer, Calc, Impress, etc.) from your
desktop menu. On first start a few files will be installed in the
user's home, if necessary.
--------------------------------------------------------------------------------
ChangeLog:
* Thu Jan 27 2011 Caolán McNamara <caolanm at redhat.com>- 1:3.2.0-12.35
- CVE-2010-3450 Extensions and filter package files
- CVE-2010-3451 / CVE-2010-3452 RTF documents
- CVE-2010-3453 / CVE-2010-3454 Word documents
- CVE-2010-3689 LD_LIBRARY_PATH usage
- CVE-2010-4253 PNG graphics
- CVE-2010-4643 TGA graphics
- Resolves: rhbz#648475 Crash in scanner dialog
- Resolves: rhbz#657628 divide-by-zero
- Resolves: rhbz#657718 Crash in SwObjectFormatterTxtFrm
- Resolves: rhbz#660312 SDK setup script creates invalid variables
(dtardon)
- Resolves: rhbz#663780 extend neon mutex locking
- Resoves: rhbz#577525 [abrt] crash in ImplRegionBase::~ImplRegionBase
(dtardon)
* Tue Oct 26 2010 Caolán McNamara <caolanm at redhat.com> - 1:3.2.0-12.34
- Resolves: rhbz#636521 crash in undo in sc
- Resolves: rhbz#641637 [abrt] [presentation-minimizer] crash in
OptimizationStats::GetStatusValue (dtardon)
- make LD_PRELOAD of libsalalloc_malloc.so work again (dtardon)
- Resolves: rhbz#642996 [abrt] CffSubsetterContext::readDictOp (dtardon)
* Fri Oct 15 2010 Caolán McNamara <caolanm at redhat.com> - 1:3.2.0-12.33
- Resolves: rhbz#637838 Cropped pictures are displayed in entirety in
handouts (dtardon)
* Tue Oct 12 2010 Caolán McNamara <caolanm at redhat.com> - 1:3.2.0-12.32
- Resolves: rhbz#568277 workaround to avoid the crash (dtardon)
- Resolves: rhbz#631543 [abrt] crash on dereferencing dangling
pointer passed down from SwCalc::Str2Double (dtardon)
- Resolves: rhbz#631823 Line and Filling toolbar glitch on theme
change (caolanm)
- Resolves: rhbz#637738 threading problems with using libgcrypt via neon when
libgcrypt which was initialized by cups to be non-thread safe (caolanm)
- Resolves: rhbz#632326 [abrt] [docx] _Construct<long, long> crash
(dtardon)
* Fri Aug 13 2010 Caolán McNamara <caolanm at redhat.com> - 1:3.2.0-12.31
- Resolves: rhbz#623800 gnome-shell/mutter focus problems
* Thu Aug 12 2010 Caolán McNamara <caolanm at redhat.com> - 1:3.2.0-12.30
- Resolves: rhbz#623609 CVE-2010-2935 CVE-2010-2936
* Mon Aug 9 2010 Caolán McNamara <caolanm at redhat.com> - 1:3.2.0-12.29
- Resolves: rhbz#601621 avoid using mmap for copying files
* Sun Aug 8 2010 Caolán McNamara <caolanm at redhat.com> - 1:3.2.0-12.28
- Resolves: rhbz#621248 32bit events in forms on 64bit
- Resolves rhbz#618047 Brackets incorrectly render in presentations
(dtardon)
* Wed Aug 4 2010 Caolán McNamara <caolanm at redhat.com> - 1:3.2.0-12.27
- Resolves: rhbz#608114 cppu-lifecycle issues (caolanm)
- Resolves: rhbz#566831 [abrt] crash in GetFrmSize (dtardon)
- Resolves: rhbz#613278 [abrt] crash in SANE shutdown (caolanm)
- Resolves: rhbz#620390 [abrt] crash in SfxViewFrame::GetFrame (dtardon)
* Mon Jun 21 2010 Caolán McNamara <caolanm at redhat.com> - 1:3.2.0-12.26
- Resolves: rhbz#606021 openoffice.org-3.3.0.ooo112567.vcl.embeddedbitmaps.patch
* Fri Jun 18 2010 Caolán McNamara <caolanm at redhat.com> - 1:3.2.0-12.25
- Resolves: rhbz#602631 dual head fixes add workspace.ooo321gsl05.patch
- Resolves: rhbz#603298 crash in ImplFontCharMap::GetGlyphIndex
- Resolves: rhbz#601890/ooo#112384 avoid crash on export to .doc
- Resolves: rhbz#603043/ooo#112386 improve gtk fpicker stability
- Resolves: rhbz#605594 openoffice.org-3.3.0.ooo112516.sw.avoid.divbyzero.patch
- Resolves: rhbz#604850 openoffice.org-3.3.0.ooo107490.cppu.lifecycle.patch
* Sat Jun 5 2010 Caolán McNamara <caolanm at redhat.com> - 1:3.2.0-12.24
- Resolves: CVE-2010-0395 openoffice.org-3.2.1.pyuno.patch
- Resolves: rhbz#596807 openoffice.org-3.2.0.ooo111886.sw.layout.workaround.patch
- Protect against broken samba servers (caolanm)
- Resolves: rhbz#597820 workspace.sw321bf01.patch (dtardon)
- Resolves: rhbz#598052 workspace.cmcfixes75.patch (caolanm)
- Resolves: rhbz#598582 openoffice.org-3.2.1.ooo112027.writerfilter.avoid.recursetodeath.patch (caolanm)
- Resolves: rhbz#599287 openoffice.org-3.3.0.ooo112059.sw.avoid-null-ptr-deref.patch (dtardon)
- Resolves: rhbz#599585 workspace.os140.patch (dtardon)
- Resolves: rhbz#596980 workspace.vcl112.patch (caolanm)
* Fri May 21 2010 Caolán McNamara <caolanm at redhat.com> - 1:3.2.0-12.23
- Resolves: rhbz#594035 openoffice.org-3.3.0.ooo111758.sd.xerror.patch
* Wed May 19 2010 Caolán McNamara <caolanm at redhat.com> - 1:3.2.0-12.22
- Resolves: rhbz#593561 openoffice.org-3.3.0.ooo111699.svx.nullfield.patch
* Fri May 7 2010 Caolán McNamara <caolanm at redhat.com> - 1:3.2.0-12.21
- Resolves: rhbz#589861 [abrt] crash in DomainMapper_Impl::finishParagraph
- Resolves: rhbz#589889 don't require exact zh fonts
* Thu May 6 2010 Caolán McNamara <caolanm at redhat.com> - 1:3.2.0-12.20
- Related: rhbz#587419 copy attributes correctly (dtardon)
* Fri Apr 30 2010 Caolán McNamara <caolanm at redhat.com> - 1:3.2.0-12.19
- Resolves: rhbz#587419 [abrt] crash in SwTxtFtn::CopyFtn (dtardon)
* Wed Apr 28 2010 Caolán McNamara <caolanm at redhat.com> - 1:3.2.0-12.18
- Resolves: rhbz#586446 openoffice.org-3.3.0.ooo93818.sw.postitprint.patch
- add openoffice.org-3.2.0.ooo101131.sw.size.mismatch.patch
* Sun Apr 25 2010 Caolán McNamara <caolanm at redhat.com> - 1:3.2.0-12.17
- Resolves: rhbz#583386 docx import crash
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #602324 - CVE-2010-3450 OpenOffice.org: directory traversal flaws in handling of XSLT jar filter descriptions and OXT extension files
https://bugzilla.redhat.com/show_bug.cgi?id=602324
[ 2 ] Bug #641282 - CVE-2010-3451 OpenOffice.org: Array index error by insecure parsing of broken rtf tables
https://bugzilla.redhat.com/show_bug.cgi?id=641282
[ 3 ] Bug #640241 - CVE-2010-3452 OpenOffice.org: Integer signedness error (crash) by processing certain RTF tags
https://bugzilla.redhat.com/show_bug.cgi?id=640241
[ 4 ] Bug #640950 - CVE-2010-3453 OpenOffice.org: Heap-based buffer overflow by processing *.doc files with WW8 list styles with specially-crafted count of list levels
https://bugzilla.redhat.com/show_bug.cgi?id=640950
[ 5 ] Bug #640954 - CVE-2010-3454 OpenOffice.org: Array index error by scanning document typography information of certain *.doc files
https://bugzilla.redhat.com/show_bug.cgi?id=640954
[ 6 ] Bug #641224 - CVE-2010-3689 OpenOffice.org: soffice insecure LD_LIBRARY_PATH setting
https://bugzilla.redhat.com/show_bug.cgi?id=641224
[ 7 ] Bug #658259 - CVE-2010-4253 OpenOffice.org: heap based buffer overflow in PPT import
https://bugzilla.redhat.com/show_bug.cgi?id=658259
[ 8 ] Bug #667588 - CVE-2010-4643 OpenOffice.org: heap based buffer overflow when parsing TGA files
https://bugzilla.redhat.com/show_bug.cgi?id=667588
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update openoffice.org' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
More information about the package-announce
mailing list