Multiple vulnerabilities in OpenOffice.org (CVE-2007-574{5-7}, CVE-2008-0320)

[Till Ulen]

Binary package hint: openoffice.org

From the Debian security advisory DSA 1547-1:

"CVE-2007-5745, CVE-2007-5747

   Several bugs have been discovered in the way OpenOffice.org parses
   Quattro Pro files that may lead to a overflow in the heap
   potentially leading to the execution of arbitrary code.

CVE-2007-5746

   Specially crafted EMF files can trigger a buffer overflow in the
   heap that may lead to the execution of arbitrary code.

CVE-2008-0320

   A bug has been discovered in the processing of OLE files that can
   cause a buffer overflow in the heap potentially leading to the
   execution of arbitrary code."

[...]

"For the stable distribution (etch) these problems have been fixed in
version 2.0.4.dfsg.2-7etch5.

For the testing (lenny) and unstable (sid) distributions these
problems have been fixed in version 2.4.0~ooh680m5-1."

http://www.debian.org/security/2008/dsa-1547

[Chris Cheney (ccheney)]

Fix committed and waiting on security team to upload.

[disabled.user (disabled.user-deactivatedaccount)]

Any progress on this?

[Kees Cook (kees)]

Addressed by USN: http://www.ubuntu.com/usn/usn-609-1