Detections
Analytics
Mandriva Linux Security Advisory : openoffice.org (MDVSA-2010:105)
high Nessus Plugin ID 46699
Language:
Synopsis
The remote Mandriva Linux host is missing one or more security updates.Description
This updates provides a new OpenOffice.org version 3.1.1. It holds security and bug fixes described as follow :An integer underflow might allow remote attackers to execute arbitrary code via crafted records in the document table of a Word document, leading to a heap-based buffer overflow (CVE-2009-0200).
A heap-based buffer overflow might allow remote attackers to execute arbitrary code via unspecified records in a crafted Word document, related to table parsing (CVE-2009-0201).
A heap-based buffer overflow allows remote attackers to execute arbitrary code via a crafted EMF file (CVE-2009-2139).
Multiple heap-based buffer overflows allow remote attackers to execute arbitrary code via a crafted EMF+ file (CVE-2009-2140).
OpenOffice's xmlsec uses a bundled Libtool which might load .la file in the current working directory allowing local users to gain privileges via a Trojan horse file. For enabling such vulnerability xmlsec has to use --enable-crypto_dl building flag however it does not, although the fix keeps protected against this threat whenever that flag had been enabled (CVE-2009-3736).
Addittionaly this update provides following bug fixes :
OpenOffice.org is not properly configure to use the xdg-email functionality of the FreeDesktop standard (#52195).
Template desktop icons are not properly set up then they are not presented under the context menu of applications like Dolphin (#56439).
libia_ora-gnome is added as suggest as long as that package is needed for a better look (#57385#c28).
It is enabled a fallback logic to properly select an OpenOffice.org style whenever one is set up but that is not installed (#57530#c1, #53284, #45133, #39043)
It is enabled the Firefox plugin for viewing OpenOffice.org documents inside browser.
Further packages were provided to supply OpenOffice.org. 3.1.1 dependencies.
Solution
Update the affected packages.Plugin Details
Severity: High
ID: 46699
File Name: mandriva_MDVSA-2010-105.nasl
Version: 1.16
Type: local
Family: Mandriva Local Security Checks
Published: 5/24/2010
Updated: 1/6/2021
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.5
CVSS v2
Risk Factor: High
Base Score: 9.3
Temporal Score: 6.9
Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C
Vulnerability Information
CPE: p-cpe:/a:mandriva:linux:openoffice.org-help-ta, p-cpe:/a:mandriva:linux:openoffice.org-l10n-af, p-cpe:/a:mandriva:linux:openoffice.org-help-da, p-cpe:/a:mandriva:linux:openoffice.org-l10n-nl, p-cpe:/a:mandriva:linux:openoffice.org-l10n-zh_tw, p-cpe:/a:mandriva:linux:openoffice.org-help-ar, p-cpe:/a:mandriva:linux:openoffice.org-l10n-eu, p-cpe:/a:mandriva:linux:openoffice.org-help-zu, p-cpe:/a:mandriva:linux:openoffice.org-pyuno, p-cpe:/a:mandriva:linux:openoffice.org-help-tr, p-cpe:/a:mandriva:linux:openoffice.org-help-et, p-cpe:/a:mandriva:linux:openoffice.org-l10n-br, p-cpe:/a:mandriva:linux:openoffice.org-style-hicontrast, p-cpe:/a:mandriva:linux:openoffice.org-base, p-cpe:/a:mandriva:linux:openoffice.org-calc, p-cpe:/a:mandriva:linux:libjack-devel, p-cpe:/a:mandriva:linux:openoffice.org-devel-doc, p-cpe:/a:mandriva:linux:openoffice.org-help-pt_br, p-cpe:/a:mandriva:linux:openoffice.org-help-af, p-cpe:/a:mandriva:linux:openoffice.org-l10n-pl, p-cpe:/a:mandriva:linux:jackit, p-cpe:/a:mandriva:linux:openoffice.org-help-cy, p-cpe:/a:mandriva:linux:openoffice.org-l10n-es, p-cpe:/a:mandriva:linux:libjack0, p-cpe:/a:mandriva:linux:libvigra-devel, p-cpe:/a:mandriva:linux:openoffice.org-common, p-cpe:/a:mandriva:linux:openoffice.org-math, cpe:/o:mandriva:linux:2009.0, p-cpe:/a:mandriva:linux:openoffice.org-help-eu, p-cpe:/a:mandriva:linux:openoffice.org-l10n-it, p-cpe:/a:mandriva:linux:openoffice.org-help-pt, p-cpe:/a:mandriva:linux:libvigra2, p-cpe:/a:mandriva:linux:openoffice.org-l10n-mk, p-cpe:/a:mandriva:linux:openoffice.org-help-it, p-cpe:/a:mandriva:linux:openoffice.org-help-de, p-cpe:/a:mandriva:linux:openoffice.org-help-en_gb, p-cpe:/a:mandriva:linux:openoffice.org, p-cpe:/a:mandriva:linux:openoffice.org-l10n-bg, p-cpe:/a:mandriva:linux:openoffice.org-l10n-nn, p-cpe:/a:mandriva:linux:openoffice.org-l10n-ja, p-cpe:/a:mandriva:linux:openoffice.org-style-crystal, p-cpe:/a:mandriva:linux:openoffice.org-help-fi, p-cpe:/a:mandriva:linux:openoffice.org-help-pl, p-cpe:/a:mandriva:linux:openoffice.org-l10n-zh_cn, p-cpe:/a:mandriva:linux:openoffice.org-help-ko, p-cpe:/a:mandriva:linux:openoffice.org-devel, p-cpe:/a:mandriva:linux:openoffice.org-l10n-tr, p-cpe:/a:mandriva:linux:openoffice.org-help-br, p-cpe:/a:mandriva:linux:openoffice.org-draw, p-cpe:/a:mandriva:linux:openoffice.org-help-en_us, p-cpe:/a:mandriva:linux:openoffice.org-help-ca, p-cpe:/a:mandriva:linux:openoffice.org-help-zh_tw, p-cpe:/a:mandriva:linux:openoffice.org-wiki-publisher, p-cpe:/a:mandriva:linux:openoffice.org-writer, p-cpe:/a:mandriva:linux:openoffice.org-l10n-ru, p-cpe:/a:mandriva:linux:openoffice.org-help-hi, p-cpe:/a:mandriva:linux:lib64jack-devel, p-cpe:/a:mandriva:linux:openoffice.org-help-es, p-cpe:/a:mandriva:linux:openoffice.org-l10n-sl, p-cpe:/a:mandriva:linux:openoffice.org-l10n-fi, p-cpe:/a:mandriva:linux:openoffice.org-help-fr, p-cpe:/a:mandriva:linux:openoffice.org-help-sk, p-cpe:/a:mandriva:linux:openoffice.org-style-tango, p-cpe:/a:mandriva:linux:openoffice.org-l10n-sv, p-cpe:/a:mandriva:linux:openoffice.org-help-nn, p-cpe:/a:mandriva:linux:openoffice.org-help-bs, p-cpe:/a:mandriva:linux:openoffice.org-l10n-ta, p-cpe:/a:mandriva:linux:openoffice.org-l10n-fr, p-cpe:/a:mandriva:linux:openoffice.org-openclipart, p-cpe:/a:mandriva:linux:openoffice.org-l10n-pt, p-cpe:/a:mandriva:linux:openoffice.org-help-zh_cn, p-cpe:/a:mandriva:linux:openoffice.org-mono, p-cpe:/a:mandriva:linux:openoffice.org-help-ru, p-cpe:/a:mandriva:linux:openoffice.org-l10n-cs, p-cpe:/a:mandriva:linux:openoffice.org-l10n-hi, p-cpe:/a:mandriva:linux:openoffice.org-help-nl, p-cpe:/a:mandriva:linux:lib64vigra2, p-cpe:/a:mandriva:linux:openoffice.org-help-ja, p-cpe:/a:mandriva:linux:openoffice.org-filter-binfilter, p-cpe:/a:mandriva:linux:openoffice.org-style-galaxy, p-cpe:/a:mandriva:linux:openoffice.org-help-he, p-cpe:/a:mandriva:linux:openoffice.org-help-nb, p-cpe:/a:mandriva:linux:openoffice.org-testtool, p-cpe:/a:mandriva:linux:openoffice.org-presentation-minimizer, p-cpe:/a:mandriva:linux:openoffice.org-help-el, p-cpe:/a:mandriva:linux:openoffice.org-presenter-screen, p-cpe:/a:mandriva:linux:openoffice.org-help-mk, p-cpe:/a:mandriva:linux:openoffice.org-l10n-pt_br, p-cpe:/a:mandriva:linux:openoffice.org-l10n-ko, p-cpe:/a:mandriva:linux:openoffice.org-help-hu, p-cpe:/a:mandriva:linux:openoffice.org-l10n-nb, p-cpe:/a:mandriva:linux:openoffice.org-l10n-hu, p-cpe:/a:mandriva:linux:openoffice.org-help-sl, p-cpe:/a:mandriva:linux:openoffice.org-impress, p-cpe:/a:mandriva:linux:openoffice.org-l10n-cy, p-cpe:/a:mandriva:linux:lib64vigra-devel, p-cpe:/a:mandriva:linux:openoffice.org-l10n-ar, p-cpe:/a:mandriva:linux:openoffice.org-l10n-bs, p-cpe:/a:mandriva:linux:openoffice.org-java-common, p-cpe:/a:mandriva:linux:openoffice.org-l10n-zu, p-cpe:/a:mandriva:linux:openoffice.org-l10n-en_gb, p-cpe:/a:mandriva:linux:openoffice.org-help-bg, p-cpe:/a:mandriva:linux:openoffice.org-l10n-he, p-cpe:/a:mandriva:linux:openoffice.org-gnome, p-cpe:/a:mandriva:linux:openoffice.org-pdfimport, p-cpe:/a:mandriva:linux:openoffice.org-core, p-cpe:/a:mandriva:linux:openoffice.org-l10n-ca, p-cpe:/a:mandriva:linux:openoffice.org-l10n-de, p-cpe:/a:mandriva:linux:openoffice.org-l10n-sk, p-cpe:/a:mandriva:linux:openoffice.org-l10n-da, p-cpe:/a:mandriva:linux:lib64jack0, p-cpe:/a:mandriva:linux:openoffice.org-style-industrial, p-cpe:/a:mandriva:linux:openoffice.org-l10n-et, p-cpe:/a:mandriva:linux:openoffice.org-help-cs, p-cpe:/a:mandriva:linux:openoffice.org-help-sv, p-cpe:/a:mandriva:linux:jackit-example-clients, p-cpe:/a:mandriva:linux:openoffice.org-l10n-el
Required KB Items: Host/local_checks_enabled, Host/cpu, Host/Mandrake/release, Host/Mandrake/rpm-list
Exploit Ease: No known exploits are available
Patch Publication Date: 5/21/2010
Reference Information
CVE: CVE-2009-0200, CVE-2009-0201, CVE-2009-2139, CVE-2009-2140, CVE-2009-3736