Security World: [SECURITY] [DSA 1995-1] New openoffice.org packages fix several vulnerabilities

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ------------------------------------------------------------------------
Debian Security Advisory DSA-1995-1 security@debian.org
http://www.debian.org/security/ Moritz Muehlenhoff
February 12, 2010 http://www.debian.org/security/faq
- ------------------------------------------------------------------------

Package : openoffice.org
Vulnerability : several
Problem type : local(remote)
Debian-specific: no
CVE Id(s) : CVE-2010-0136 CVE-2009-0217 CVE-2009-2949 CVE-2009-2950 CVE-2009-3301 CVE-2009-3302

Several vulnerabilities have been discovered in the OpenOffice.org office
suite. The Common Vulnerabilities and Exposures project identifies the
following problems:

CVE-2010-0136

It was discovered that macro security settings were insufficiently
enforced for VBA macros.

CVE-2009-0217

It was discovered that the W3C XML Signature recommendation
contains a protocol-level vulnerability related to HMAC output
truncation. This also affects the integrated libxmlsec library.

CVE-2009-2949

Sebastian Apelt discovered that an integer overflow in the XPM
import code may lead to the execution of arbitrary code.

CVE-2009-2950

Sebastian Apelt and Frank Reissner discovered that a buffer
overflow in the GIF import code may lead to the execution of
arbitrary code.

CVE-2009-3301/CVE-2009-3302

Nicolas Joly discovered multiple vulnerabilities in the parser for
Word document files, which may lead to the execution of arbitrary
code.

For the old stable distribution (etch), these problems have been fixed in
version 2.0.4.dfsg.2-7etch9.

For the stable distribution (lenny), these problems have been fixed in
version 1:2.4.1+dfsg-1+lenny6.

For the unstable distribution (sid), these problems will be fixed soon.

We recommend that you upgrade your openoffice.org packages.

Upgrade instructions
- --------------------

wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
will update the internal database
apt-get upgrade
will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian GNU/Linux 4.0 alias etch
- -------------------------------

Oldstable updates are available for alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.

Source archives:

http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org_2.0.4.dfsg.2-7etch9.diff.gz
Size/MD5 checksum: 76916303 5bc5cd4de218c953e873f184940627e9
http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org_2.0.4.dfsg.2-7etch8.dsc
Size/MD5 checksum: 7899 205a9931b8c072c20074cf9010fa68f1
http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org_2.0.4.dfsg.2-7etch9.dsc
Size/MD5 checksum: 7899 2efd2f003abd66ad91e3846b7b2523fc
http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org_2.0.4.dfsg.2-7etch8.diff.gz
Size/MD5 checksum: 76919759 e64ff39e7cdc6b356e392659df1d133e
http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org_2.0.4.dfsg.2.orig.tar.gz
Size/MD5 checksum: 232674922 2f1a5d92188639d3634bd6d1b1c29038

Architecture independent packages:

alpha architecture (DEC Alpha)

http://security.debian.org/pool/updates/main/o/openoffice.org/libmythes-dev_2.0.4.dfsg.2-7etch9_alpha.deb
Size/MD5 checksum: 107494 4857ebf19411823565d93ce22ba83fc1

amd64 architecture (AMD x86_64 (AMD64))

arm architecture (ARM)

http://security.debian.org/pool/updates/main/o/openoffice.org/libmythes-dev_2.0.4.dfsg.2-7etch9_arm.deb
Size/MD5 checksum: 105650 a3f60fff225cf59d3c9426f0d7e23849

hppa architecture (HP PA RISC)

http://security.debian.org/pool/updates/main/o/openoffice.org/libmythes-dev_2.0.4.dfsg.2-7etch9_hppa.deb
Size/MD5 checksum: 107164 7e4af832a59f4fd6ccb5f98be3fb430d

i386 architecture (Intel ia32)

ia64 architecture (Intel ia64)

http://security.debian.org/pool/updates/main/o/openoffice.org/libmythes-dev_2.0.4.dfsg.2-7etch9_ia64.deb
Size/MD5 checksum: 105690 ea4c0e6a7282b38bac0043f4e1c66122
http://security.debian.org/pool/updates/main/o/openoffice.org/libmythes-dev_2.0.4.dfsg.2-7etch8_ia64.deb
Size/MD5 checksum: 105658 da9425f724003799bb83c3330041b92a

mips architecture (MIPS (Big Endian))

http://security.debian.org/pool/updates/main/o/openoffice.org/libmythes-dev_2.0.4.dfsg.2-7etch8_mips.deb
Size/MD5 checksum: 105450 23d12452be36a1360aefbeebd16833aa
http://security.debian.org/pool/updates/main/o/openoffice.org/libmythes-dev_2.0.4.dfsg.2-7etch9_mips.deb
Size/MD5 checksum: 104166 f6a059ab976188aad531020568eb5619

mipsel architecture (MIPS (Little Endian))

http://security.debian.org/pool/updates/main/o/openoffice.org/libmythes-dev_2.0.4.dfsg.2-7etch9_mipsel.deb
Size/MD5 checksum: 104228 28c3c72a27d5b4a8d8373556ae8433ad

powerpc architecture (PowerPC)

s390 architecture (IBM S/390)

http://security.debian.org/pool/updates/main/o/openoffice.org/libmythes-dev_2.0.4.dfsg.2-7etch8_s390.deb
Size/MD5 checksum: 106058 0991dd3b4cdef14e5ef2574fcd19ea9e
http://security.debian.org/pool/updates/main/o/openoffice.org/libmythes-dev_2.0.4.dfsg.2-7etch9_s390.deb
Size/MD5 checksum: 106108 0c3335caffd4f63f45f7d833f356c693

sparc architecture (Sun SPARC/UltraSPARC)

Debian GNU/Linux 5.0 alias lenny
- --------------------------------

Stable updates are available for alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.

Source archives:

http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org_2.4.1+dfsg-1+lenny5.diff.gz
Size/MD5 checksum: 84244794 fa5d121b5e307782d4c7782d83b440b8
http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org_2.4.1+dfsg-1+lenny5.dsc
Size/MD5 checksum: 9765 8625cb0c703684fce8e020a2fa85efb8
http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org_2.4.1+dfsg-1+lenny6.diff.gz
Size/MD5 checksum: 84244791 52c146b8f15ce2277c8c92faa84028fb
http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org_2.4.1+dfsg-1+lenny4.dsc
Size/MD5 checksum: 9765 53abf599c4212ad623021f06a518f158
http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org_2.4.1+dfsg-1+lenny6.dsc
Size/MD5 checksum: 9765 601660b2741b94b4325bac62753e68c5
http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org_2.4.1+dfsg-1+lenny4.diff.gz
Size/MD5 checksum: 84252995 ed96a572793a98ddf8d2f4c17e2f69aa
http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org_2.4.1+dfsg.orig.tar.gz
Size/MD5 checksum: 278867131 152a6c5b8e1b4e042ec027cca964e443

Architecture independent packages:

amd64 architecture (AMD x86_64 (AMD64))

armel architecture (ARM EABI)

i386 architecture (Intel ia32)

ia64 architecture (Intel ia64)

mips architecture (MIPS (Big Endian))

mipsel architecture (MIPS (Little Endian))

powerpc architecture (PowerPC)

s390 architecture (IBM S/390)

sparc architecture (Sun SPARC/UltraSPARC)

These files will probably be moved into the stable distribution on
its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iEYEARECAAYFAkt1nFEACgkQXm3vHE4uylpcPgCgtpnUwT5IJMQNe3KQMkrLYxyi
smsAoKIpwcZIp6bXW38KZE3Kr29vU4Jt
=+shR
-----END PGP SIGNATURE-----

--
To UNSUBSCRIBE, email to debian-security-announce-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

Security World

Friday, February 12, 2010

[SECURITY] [DSA 1995-1] New openoffice.org packages fix several vulnerabilities

No comments:

Post a Comment