drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Ausführen beliebiger Kommandos in OpenOffice
Name: |
Ausführen beliebiger Kommandos in OpenOffice |
|
ID: |
201703-01 |
|
Distribution: |
Gentoo |
|
Plattformen: |
Keine Angabe |
|
Datum: |
So, 19. März 2017, 22:45 |
|
Referenzen: |
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-1513
http://www.talosintelligence.com/reports/TALOS-2016-0051/ |
|
Applikationen: |
Apache OpenOffice |
|
Originalnachricht |
This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --NWvwHowAo2uuMfRCSaQHUELh51ah3hiJg Content-Type: multipart/mixed; boundary="aCA0dWME3xTJIMHoqEEa6W7GASEF9jcGP"; protected-headers="v1" From: Thomas Deutschmann <whissi@gentoo.org> Reply-To: security@gentoo.org To: gentoo-announce@lists.gentoo.org Message-ID: <f84643e1-5d8b-5e75-989a-3e96b2125e5a@gentoo.org> Subject: [ GLSA 201703-01 ] OpenOffice: User-assisted execution of arbitrary code
--aCA0dWME3xTJIMHoqEEa6W7GASEF9jcGP Content-Type: text/plain; charset=utf- Content-Transfer-Encoding: quoted-printable
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201703-01 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal Title: OpenOffice: User-assisted execution of arbitrary code Date: March 19, 2017 Bugs: #597080 ID: 201703-01
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis ========
A vulnerability in OpenOffice Impress could cause memory corruption.
Background ==========
Apache OpenOffice is an open-source office software suite for word processing, spreadsheets, presentations, graphics, databases and more.
Affected packages =================
------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 app-office/openoffice-bin < 4.1.3 >= 4.1.3
Description ===========
An exploitable out-of-bounds vulnerability exists in OpenOffice Impress when handling MetaActions.
Impact ======
A remote attacker could entice a user to open a specially crafted OpenDocument Presentation .ODP or Presentation Template .OTP file using OpenOffice Impress, possibly resulting in execution of arbitrary code with the privileges of the process or a Denial of Service condition.
Workaround ==========
There is no known workaround at this time.
Resolution ==========
All OpenOffice users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot -v ">=app-office/openoffice-bin-4.1.3"
References ==========
[ 1 ] CVE-2016-1513 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-1513 [ 2 ] TALOS-2016-0051 http://www.talosintelligence.com/reports/TALOS-2016-0051/
Availability ============
This GLSA and any updates to it are available for viewing at the Gentoo Security Website:
https://security.gentoo.org/glsa/201703-01
Concerns? =========
Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.
License =======
Copyright 2017 Gentoo Foundation, Inc; referenced text belongs to its owner(s).
The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
--aCA0dWME3xTJIMHoqEEa6W7GASEF9jcGP--
--NWvwHowAo2uuMfRCSaQHUELh51ah3hiJg Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc"
-----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0
iQJ8BAEBCgBmBQJYztALXxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXQzM0M1ODQ4MkM0MDIyOTJEMkUzQzVDMDY5 NzA5RjkwQzNDOTZGRkM4AAoJEJcJ+Qw8lv/IQXoP/0tYzZfacHeedEpI3eCmBzEA 0go5LZYQ9LwT++2Xc8rlBt+kKk9eGNMLoSfQjlLHrAG7uqb1sw1K3jN/nXY+C7Zl yUsm8Lu5Al94+nTY4IzRxkqVqos+T1t9ev0mQvHt21lTlvSHGgtQ93oJlGGG8ZLG mj5Cw3EXBV3ypOJNmCee1t8KVgVHg0w7pfvHiHV5Uyw2SlXMMx7CJYVohJUMLVHc mHdrLunuJnevDWe011yryV8uImTjHf2C5euhyvNuVAZWWFVL9qPhG8K1gZH8Vfda BCbA+IRs49TofU7waPA5nxOLExBqE5rcanbIgCJeJ7Jbwtz+8i9yiQjl3uYBKyTL 097b4Ar+bPesQ3nISatMXBIVj57q3vq6gsVazpL/hvh2Kz+mIGYvlGuhLQjSqjIF xYunweqQxhHEBaAH/mzUBwaXPpW2uQurxaKIYnGcH3fWIEZWHNbMLpDKHu5LA7N1 rkEe+Vg3V4BOoATnvXqWvTmi0pcjmG+na/6rNHomR+yZ/VF75u5uSH+1XEZv6kBk JJj1azK/zx94Cn9DRt336Rv3bLheEyW5b9DO3Y4Qle5W1QcjgvjXy2UHTTR3sUUM gyOg4YyIqGEwrq7EmgT0GiRXWKl+ERsPrbTEY1HTPWHTbFxD7hn7iTsM8xzrJWTF NjOCJ0AH18dgCSAI3+d5 =DmfX -----END PGP SIGNATURE-----
--NWvwHowAo2uuMfRCSaQHUELh51ah3hiJg--
|
|
|
|