USN-121-1: OpenOffice.org vulnerability
6 May 2005
OpenOffice.org vulnerability
Releases
Details
The StgCompObjStream::Load() failed to check the validity of a length
field in documents. If an attacker tricked a user to open a specially
crafted OpenOffice file, this triggered a buffer overflow which could
lead to arbitrary code execution with the privileges of the user
opening the document.
The update for Ubuntu 5.04 (Hoary Hedgehog) also contains a
translation update: The "openoffice.org-l10n-xh" package now contains
actual Xhosa translations (the previous version just shipped English
strings).
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 5.04
-
openoffice.org-l10n-xh
-
-
openoffice.org-bin
-
Ubuntu 4.10
-
openoffice.org-l10n-xh
-
-
openoffice.org-bin
-
In general, a standard system update will make all the necessary changes.