rPSA-2006-0173-1 openoffice.org
rPath Security Advisory: 2006-0173-1
Published: 2006-09-26
Products: rPath Linux 1
Rating: Major
Exposure Level Classification:
Indirect User Deterministic Unauthorized Access
Updated Versions:
openoffice.org=/conary.rpath.com@rpl:devel//1/2.0.3-1.6-1
References:
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2198
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3117
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2199
https://issues.rpath.com/browse/RPL-475
Description:
Previous versions of the openoffice.org packages are susceptible
to several vulnerabilities, including a denial of service (application
crash) and a user-complicit unauthorized access attack that enables
an attacker to cause arbitrary code to be run. These versions are
not susceptible to CVE-2006-2199 because Java is not enabled in
those builds.
Because Java support could not be disabled in the initial release
of OpenOffice.org 2.0.3, and because Java support is not included
within rPath Linux 1, this update was delayed until non-Java builds
were re-enabled in OpenOffice.org.