| Description: | Description:
The remote host is missing updates announced in
advisory RHSA-2010:0643.
OpenOffice.org is an office productivity suite that includes desktop
applications, such as a word processor, spreadsheet application,
presentation manager, formula editor, and a drawing program.
An integer truncation error, leading to a heap-based buffer overflow, was
found in the way the OpenOffice.org Impress presentation application
sanitized a file's dictionary property items. An attacker could use this
flaw to create a specially-crafted Microsoft Office PowerPoint file that,
when opened, would cause OpenOffice.org Impress to crash or, possibly,
execute arbitrary code with the privileges of the user running
OpenOffice.org Impress. (CVE-2010-2935)
An integer overflow flaw, leading to a heap-based buffer overflow, was
found in the way OpenOffice.org Impress processed polygons in input
documents. An attacker could use this flaw to create a specially-crafted
Microsoft Office PowerPoint file that, when opened, would cause
OpenOffice.org Impress to crash or, possibly, execute arbitrary code with
the privileges of the user running OpenOffice.org Impress. (CVE-2010-2936)
All users of OpenOffice.org are advised to upgrade to these updated
packages, which contain backported patches to correct these issues. For Red
Hat Enterprise Linux 3, this erratum provides updated openoffice.org
packages. For Red Hat Enterprise Linux 4, this erratum provides updated
openoffice.org and openoffice.org2 packages. All running instances of
OpenOffice.org applications must be restarted for this update to take
effect.
Solution:
Please note that this update is available via
Red Hat Network. To use Red Hat Network, launch the Red
Hat Update Agent with the following command: up2date
http://rhn.redhat.com/errata/RHSA-2010-0643.html
http://www.redhat.com/security/updates/classification/#important
Risk factor : Critical
CVSS Score:
9.3
|
