Security World: [SECURITY] [DSA 1880-1] New OpenOffice.org packages fix arbitrary code execution

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- --------------------------------------------------------------------------
Debian Security Advisory DSA 1880-1 security@debian.org
http://www.debian.org/security/ Martin Schulze
September 4th, 2009 http://www.debian.org/security/faq
- --------------------------------------------------------------------------

Package : openoffice.org
Vulnerability : several
Problem type : local (remote)
Debian-specific: no
CVE IDs : CVE-2009-0200 CVE-2009-0201 CVE-2009-2139

Several vulnerabilities have been discovered in the OpenOffice.org
office suite. The Common Vulnerabilities and Exposures project
identifies the following problems:

CVE-2009-0200

Dyon Balding of Secunia Research has discovered a vulnerability,
which can be exploited by opening a specially crafted Microsoft
Word document.

When reading a Microsoft Word document, a bug in the parser of
sprmTDelete records can result in an integer underflow that may
lead to heap-based buffer overflows.

Successful exploitation may allow arbitrary code execution in the
context of the OpenOffice.org process.

CVE-2009-0201

Dyon Balding of Secunia Research has discovered a vulnerability,
which can be exploited by opening a specially crafted Microsoft
Word document.

When reading a Microsoft Word document, a bug in the parser of
sprmTDelete records can result in heap-based buffer overflows.

Successful exploitation may allow arbitrary code execution in the
context of the OpenOffice.org process.

CVE-2009-2139

A vulnerability has been discovered in the parser of EMF files of
OpenOffice/Go-oo 2.x and 3.x that can be triggered by a specially
crafted document and lead to the execution of arbitrary commands
the privileges of the user running OpenOffice.org/Go-oo.

This vulnerability does not exist in the packages for oldstable,
testing and unstable.

For the old stable distribution (etch) these problems have been fixed in
version 2.0.4.dfsg.2-7etch7.

For the stable distribution (lenny) these problems have been fixed in
version 2.4.1+dfsg-1+lenny3 and higher.

For the unstable (sid) and testing (squeeze) distribution these
problems have been fixed in version 3.1.1~ooo310m15-1.

We recommend that you upgrade your Openoffice.org package.

Upgrade Instructions
- --------------------

wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given at the end of this advisory:

apt-get update
will update the internal database
apt-get upgrade
will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian GNU/Linux 4.0 alias etch
- -------------------------------

Source archives:

http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org_2.0.4.dfsg.2-7etch7.dsc
Size/MD5 checksum: 7250 76bc711bb7e9a04ecc62b969c63a8d55
http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org_2.0.4.dfsg.2-7etch7.diff.gz
Size/MD5 checksum: 76911819 8f022d2d93a0faf06fa022f2c8048b48
http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org_2.0.4.dfsg.2.orig.tar.gz
Size/MD5 checksum: 232674922 2f1a5d92188639d3634bd6d1b1c29038

Architecture independent components:

Alpha architecture:

http://security.debian.org/pool/updates/main/o/openoffice.org/libmythes-dev_2.0.4.dfsg.2-7etch5_alpha.deb
Size/MD5 checksum: 107204 eb8e3d346517e25317f480dad599ac0e

AMD64 architecture:

ARM architecture:

http://security.debian.org/pool/updates/main/o/openoffice.org/libmythes-dev_2.0.4.dfsg.2-7etch6_arm.deb
Size/MD5 checksum: 105102 17081ed10f4e8ec17d14374475281d7f

HP Precision architecture:

http://security.debian.org/pool/updates/main/o/openoffice.org/libmythes-dev_2.0.4.dfsg.2-7etch5_hppa.deb
Size/MD5 checksum: 106512 23833d06df1f95efc221675639afe2cd

Intel IA-32 architecture:

Intel IA-64 architecture:

http://security.debian.org/pool/updates/main/o/openoffice.org/libmythes-dev_2.0.4.dfsg.2-7etch7_ia64.deb
Size/MD5 checksum: 105530 541fb4b719976cf11973e59916c9d9ff

Big endian MIPS architecture:

http://security.debian.org/pool/updates/main/o/openoffice.org/libmythes-dev_2.0.4.dfsg.2-7etch7_mips.deb
Size/MD5 checksum: 105332 360b0ee43aea505ea2b1faf906c136db

Little endian MIPS architecture:

http://security.debian.org/pool/updates/main/o/openoffice.org/libmythes-dev_2.0.4.dfsg.2-7etch7_mipsel.deb
Size/MD5 checksum: 104060 af0dd7aece6dbc86d3b0b52b97e7931e

PowerPC architecture:

IBM S/390 architecture:

http://security.debian.org/pool/updates/main/o/openoffice.org/libmythes-dev_2.0.4.dfsg.2-7etch7_s390.deb
Size/MD5 checksum: 105954 7cf54fc5eac9424e3982dd4449483a22

Sun Sparc architecture:

Debian GNU/Linux 5.0 alias lenny
- --------------------------------

Source archives:

http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org_2.4.1+dfsg-1+lenny3.dsc
Size/MD5 checksum: 9116 91279eaf7efa2ecaa42d0690c85bed88
http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org_2.4.1+dfsg-1+lenny3.diff.gz
Size/MD5 checksum: 84240498 363f7df467c3516e7e7d2a2d5fe7bca1
http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org_2.4.1+dfsg.orig.tar.gz
Size/MD5 checksum: 278867131 152a6c5b8e1b4e042ec027cca964e443

Architecture independent components:

AMD64 architecture:

Intel IA-32 architecture:

Intel IA-64 architecture:

Big endian MIPS architecture:

Little endian MIPS architecture:

PowerPC architecture:

IBM S/390 architecture:

Sun Sparc architecture:

These files will probably be moved into the stable distribution on
its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFKoVS5W5ql+IAeqTIRAgQbAJ9/JOxocS5fSZMnuQBzvpe0R/cGQQCgqYG7
Zph75gobLaZ2R9V4SYVHqZA=
=BfWP
-----END PGP SIGNATURE-----

--
To UNSUBSCRIBE, email to debian-security-announce-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

Security World

Friday, September 04, 2009

[SECURITY] [DSA 1880-1] New OpenOffice.org packages fix arbitrary code execution

No comments:

Post a Comment