Bug 5053 - Security & bug fix release: LibreOffice 3.4.6
Summary: Security & bug fix release: LibreOffice 3.4.6
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: RPM Packages (show other bugs)
Version: 1
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact:
URL: http://blog.documentfoundation.org/20...
Whiteboard: MGA1-32-OK MGA1-64-OK
Keywords: validated_update
Depends on:
Blocks:
 
Reported: 2012-03-22 12:18 CET by Sander Lepik
Modified: 2012-06-27 00:02 CEST (History)
5 users (show)

See Also:
Source RPM: libreoffice
CVE:
Status comment:


Attachments

Description Sander Lepik 2012-03-22 12:18:06 CET
The Document Foundation (TDF) announces LibreOffice 3.4.6, solving a potential security problem and a number of bugs of the program.

http://libreoffice.ut.ee/libreoffice/src/bugfixes-libreoffice-3-4-6-release-3.4.6.1.log
http://download.documentfoundation.org/libreoffice/src/bugfixes-libreoffice-3-4-6-release-3.4.6.2.log
Comment 1 D Morgan 2012-03-22 13:15:05 CET
i will update our mga 1 to it.
Comment 2 David Walser 2012-04-21 17:38:55 CEST
Mandriva has updated MDV 2011 to 3.4.6 this morning:
http://www.mandriva.com/en/support/security/advisories/?dis=2011&name=MDVSA-2012:063

I think it would nice to have, but I'm not sure about the security issue.  The issue is in the raptor library.  I know LO includes its own copy of it, but I think our package isn't actually using it, but is instead using the system one.  It's not linked to it directly, but it is linked to librdf which is linked to libraptor, and I read a mail on the full disclosure mailing list yesterday which said that's how LO uses raptor: through librdf.

CC: (none) => luigiwalser

Comment 3 David Walser 2012-05-29 23:45:13 CEST
There's another security issue that may impact us: CVE-2012-1149.

See https://bugzilla.redhat.com/show_bug.cgi?id=821726
Comment 4 David Walser 2012-06-06 01:16:52 CEST
Also CVE-2012-2334.

See https://bugzilla.redhat.com/show_bug.cgi?id=821803
Comment 5 D Morgan 2012-06-20 00:34:13 CEST
3.4.6.2 is now in testing.  please test.
Comment 6 David Walser 2012-06-20 00:53:22 CEST
(In reply to comment #5)
> 3.4.6.2 is now in testing.  please test.

Looks like it's still building.  Hopefully it succeeds this time :o)

I see you also built 3.5.5.1 for Mageia 2.  Are you filing a bug for that one?
Comment 7 D Morgan 2012-06-20 01:39:55 CEST
no, i will for 3.5.5 final ( 3.5.5.1 is the rc1 ) i uploaded for tests and to see if it fixed bugs ( and yes :D ).

see http://wiki.documentfoundation.org/ReleasePlan#3.5_release    3.5.5 should be available in 2 weeks ( at this moment i will do a bugreport ;) )
Comment 8 David Walser 2012-06-20 03:04:14 CEST
Ahh, sounds good.  Thanks D Morgan.

BTW, do we have an advisory for this one?  Here's the packages that were built.

libreoffice-3.4.6.2-0.1.mga1
libreoffice-core-3.4.6.2-0.1.mga1
libreoffice-pyuno-3.4.6.2-0.1.mga1
libreoffice-base-3.4.6.2-0.1.mga1
libreoffice-report-builder-3.4.6.2-0.1.mga1
libreoffice-bsh-3.4.6.2-0.1.mga1
libreoffice-rhino-3.4.6.2-0.1.mga1
libreoffice-wiki-publisher-3.4.6.2-0.1.mga1
libreoffice-ogltrans-3.4.6.2-0.1.mga1
libreoffice-presentation-minimizer-3.4.6.2-0.1.mga1
libreoffice-presenter-screen-3.4.6.2-0.1.mga1
libreoffice-pdfimport-3.4.6.2-0.1.mga1
libreoffice-opensymbol-fonts-3.4.6.2-0.1.mga1
libreoffice-writer-3.4.6.2-0.1.mga1
libreoffice-emailmerge-3.4.6.2-0.1.mga1
libreoffice-calc-3.4.6.2-0.1.mga1
libreoffice-draw-3.4.6.2-0.1.mga1
libreoffice-impress-3.4.6.2-0.1.mga1
libreoffice-math-3.4.6.2-0.1.mga1
libreoffice-graphicfilter-3.4.6.2-0.1.mga1
libreoffice-xsltfilter-3.4.6.2-0.1.mga1
libreoffice-javafilter-3.4.6.2-0.1.mga1
libreoffice-testtools-3.4.6.2-0.1.mga1
libreoffice-ure-3.4.6.2-0.1.mga1
libreoffice-java-common-3.4.6.2-0.1.mga1
libreoffice-sdk-3.4.6.2-0.1.mga1
libreoffice-sdk-doc-3.4.6.2-0.1.mga1
libreoffice-headless-3.4.6.2-0.1.mga1
libreoffice-kde-3.4.6.2-0.1.mga1
libreoffice-debug-3.4.6.2-0.1.mga1
libreoffice-gdb-debug-support-3.4.6.2-0.1.mga1
libreoffice-langpack-af-3.4.6.2-0.1.mga1
libreoffice-langpack-ar-3.4.6.2-0.1.mga1
libreoffice-langpack-as-3.4.6.2-0.1.mga1
libreoffice-langpack-bg-3.4.6.2-0.1.mga1
libreoffice-langpack-bn-3.4.6.2-0.1.mga1
libreoffice-langpack-ca-3.4.6.2-0.1.mga1
libreoffice-langpack-cs-3.4.6.2-0.1.mga1
libreoffice-langpack-cy-3.4.6.2-0.1.mga1
libreoffice-langpack-da-3.4.6.2-0.1.mga1
libreoffice-langpack-de-3.4.6.2-0.1.mga1
libreoffice-langpack-dz-3.4.6.2-0.1.mga1
libreoffice-langpack-el-3.4.6.2-0.1.mga1
libreoffice-langpack-en-3.4.6.2-0.1.mga1
libreoffice-langpack-es-3.4.6.2-0.1.mga1
libreoffice-langpack-et-3.4.6.2-0.1.mga1
libreoffice-langpack-eu-3.4.6.2-0.1.mga1
libreoffice-langpack-fi-3.4.6.2-0.1.mga1
libreoffice-langpack-fr-3.4.6.2-0.1.mga1
libreoffice-langpack-ga-3.4.6.2-0.1.mga1
libreoffice-langpack-gl-3.4.6.2-0.1.mga1
libreoffice-langpack-gu-3.4.6.2-0.1.mga1
libreoffice-langpack-he-3.4.6.2-0.1.mga1
libreoffice-langpack-hi-3.4.6.2-0.1.mga1
libreoffice-langpack-hr-3.4.6.2-0.1.mga1
libreoffice-langpack-hu-3.4.6.2-0.1.mga1
libreoffice-langpack-it-3.4.6.2-0.1.mga1
libreoffice-langpack-ja-3.4.6.2-0.1.mga1
libreoffice-langpack-kn-3.4.6.2-0.1.mga1
libreoffice-langpack-ko-3.4.6.2-0.1.mga1
libreoffice-langpack-lt-3.4.6.2-0.1.mga1
libreoffice-langpack-mai-3.4.6.2-0.1.mga1
libreoffice-langpack-ml-3.4.6.2-0.1.mga1
libreoffice-langpack-mr-3.4.6.2-0.1.mga1
libreoffice-langpack-nb-3.4.6.2-0.1.mga1
libreoffice-langpack-nl-3.4.6.2-0.1.mga1
libreoffice-langpack-nn-3.4.6.2-0.1.mga1
libreoffice-langpack-nr-3.4.6.2-0.1.mga1
libreoffice-langpack-nso-3.4.6.2-0.1.mga1
libreoffice-langpack-or-3.4.6.2-0.1.mga1
libreoffice-langpack-pa-3.4.6.2-0.1.mga1
libreoffice-langpack-pl-3.4.6.2-0.1.mga1
libreoffice-langpack-pt-BR-3.4.6.2-0.1.mga1
libreoffice-langpack-pt-PT-3.4.6.2-0.1.mga1
libreoffice-langpack-ro-3.4.6.2-0.1.mga1
libreoffice-langpack-ru-3.4.6.2-0.1.mga1
libreoffice-langpack-si-3.4.6.2-0.1.mga1
libreoffice-langpack-sk-3.4.6.2-0.1.mga1
libreoffice-langpack-sl-3.4.6.2-0.1.mga1
libreoffice-langpack-sr-3.4.6.2-0.1.mga1
libreoffice-langpack-ss-3.4.6.2-0.1.mga1
libreoffice-langpack-st-3.4.6.2-0.1.mga1
libreoffice-langpack-sv-3.4.6.2-0.1.mga1
libreoffice-langpack-ta-3.4.6.2-0.1.mga1
libreoffice-langpack-te-3.4.6.2-0.1.mga1
libreoffice-langpack-th-3.4.6.2-0.1.mga1
libreoffice-langpack-tn-3.4.6.2-0.1.mga1
libreoffice-langpack-tr-3.4.6.2-0.1.mga1
libreoffice-langpack-ts-3.4.6.2-0.1.mga1
libreoffice-langpack-uk-3.4.6.2-0.1.mga1
libreoffice-langpack-ve-3.4.6.2-0.1.mga1
libreoffice-langpack-xh-3.4.6.2-0.1.mga1
libreoffice-langpack-zh_CN-3.4.6.2-0.1.mga1
libreoffice-langpack-zh_TW-3.4.6.2-0.1.mga1
libreoffice-langpack-zu-3.4.6.2-0.1.mga1
autocorr-en-3.4.6.2-0.1.mga1
autocorr-af-3.4.6.2-0.1.mga1
autocorr-bg-3.4.6.2-0.1.mga1
autocorr-cs-3.4.6.2-0.1.mga1
autocorr-da-3.4.6.2-0.1.mga1
autocorr-de-3.4.6.2-0.1.mga1
autocorr-es-3.4.6.2-0.1.mga1
autocorr-eu-3.4.6.2-0.1.mga1
autocorr-fa-3.4.6.2-0.1.mga1
autocorr-fi-3.4.6.2-0.1.mga1
autocorr-fr-3.4.6.2-0.1.mga1
autocorr-ga-3.4.6.2-0.1.mga1
autocorr-hr-3.4.6.2-0.1.mga1
autocorr-hu-3.4.6.2-0.1.mga1
autocorr-it-3.4.6.2-0.1.mga1
autocorr-ja-3.4.6.2-0.1.mga1
autocorr-ko-3.4.6.2-0.1.mga1
autocorr-lb-3.4.6.2-0.1.mga1
autocorr-lt-3.4.6.2-0.1.mga1
autocorr-mn-3.4.6.2-0.1.mga1
autocorr-nl-3.4.6.2-0.1.mga1
autocorr-pl-3.4.6.2-0.1.mga1
autocorr-pt-3.4.6.2-0.1.mga1
autocorr-ru-3.4.6.2-0.1.mga1
autocorr-sk-3.4.6.2-0.1.mga1
autocorr-sl-3.4.6.2-0.1.mga1
autocorr-sr-3.4.6.2-0.1.mga1
autocorr-sv-3.4.6.2-0.1.mga1
autocorr-tr-3.4.6.2-0.1.mga1
autocorr-vi-3.4.6.2-0.1.mga1
autocorr-zh-3.4.6.2-0.1.mga1
libreoffice-help-en-3.4.6.2-0.1.mga1
libreoffice-help-bg-3.4.6.2-0.1.mga1
libreoffice-help-bn-3.4.6.2-0.1.mga1
libreoffice-help-ca-3.4.6.2-0.1.mga1
libreoffice-help-cs-3.4.6.2-0.1.mga1
libreoffice-help-da-3.4.6.2-0.1.mga1
libreoffice-help-de-3.4.6.2-0.1.mga1
libreoffice-help-dz-3.4.6.2-0.1.mga1
libreoffice-help-el-3.4.6.2-0.1.mga1
libreoffice-help-es-3.4.6.2-0.1.mga1
libreoffice-help-et-3.4.6.2-0.1.mga1
libreoffice-help-eu-3.4.6.2-0.1.mga1
libreoffice-help-fi-3.4.6.2-0.1.mga1
libreoffice-help-fr-3.4.6.2-0.1.mga1
libreoffice-help-gl-3.4.6.2-0.1.mga1
libreoffice-help-hi-3.4.6.2-0.1.mga1
libreoffice-help-hu-3.4.6.2-0.1.mga1
libreoffice-help-it-3.4.6.2-0.1.mga1
libreoffice-help-ja-3.4.6.2-0.1.mga1
libreoffice-help-ko-3.4.6.2-0.1.mga1
libreoffice-help-nb-3.4.6.2-0.1.mga1
libreoffice-help-nl-3.4.6.2-0.1.mga1
libreoffice-help-nn-3.4.6.2-0.1.mga1
libreoffice-help-pl-3.4.6.2-0.1.mga1
libreoffice-help-pt_BR-3.4.6.2-0.1.mga1
libreoffice-help-pt-3.4.6.2-0.1.mga1
libreoffice-help-ru-3.4.6.2-0.1.mga1
libreoffice-help-si-3.4.6.2-0.1.mga1
libreoffice-help-sk-3.4.6.2-0.1.mga1
libreoffice-help-sl-3.4.6.2-0.1.mga1
libreoffice-help-sv-3.4.6.2-0.1.mga1
libreoffice-help-tr-3.4.6.2-0.1.mga1
libreoffice-help-uk-3.4.6.2-0.1.mga1
libreoffice-help-zh_CN-3.4.6.2-0.1.mga1
libreoffice-help-zh_TW-3.4.6.2-0.1.mga1

from libreoffice-3.4.6.2-0.1.mga1.src.rpm

CC: (none) => dmorganec
Assignee: dmorganec => qa-bugs

Comment 9 D Morgan 2012-06-20 13:22:38 CEST
Advisory:

An XML External Entity expansion flaw was found in the way Raptor
processed RDF files. If an application linked against Raptor were to
open a specially-crafted RDF file, it could possibly allow a remote
attacker to obtain a copy of an arbitrary local file that the user
running the application had access to. A bug in the way Raptor handled
external entities could cause that application to crash or, possibly,
execute arbitrary code with the privileges of the user running the
application (CVE-2012-0037).

libreoffice for Mageia 1 has been upgraded to the 3.4.6.2
version which is not vulnerable to this issue.

Reference: https://bugs.mageia.org/show_bug.cgi?id=5053
Comment 10 Samuel Verschelde 2012-06-22 17:30:07 CEST
Testing i586

I haven't found an exploit although securityfocus says "An attacker can exploit this issue using readily available tools.". 

I guess we'll have to trust libreoffice to have fixed it properly in 3.4.6.2 and make sure this bugfix release doesn't introduce obvious regressions.

So far, basic operations in writer, calc, impress work well.

CC: (none) => stormi

Comment 11 Samuel Verschelde 2012-06-22 18:13:06 CEST
Testing complete i586 (but since this is libreoffice, other testers for i586 are welcome to help validating it deeply).

I opened and saved various files, checked the automated spellchecking, it is correctly localized for my language. Only problem I had is it won't open a certain file of mine, but previous versions wouldn't either, so there's no regression here.
Samuel Verschelde 2012-06-22 18:13:22 CEST

Whiteboard: (none) => MGA1-32-OK

Comment 12 D Morgan 2012-06-23 21:45:25 CEST
can we see this update pushed then ?
Comment 13 claire robinson 2012-06-23 22:15:20 CEST
Testing completed x86_64 Mageia 1

Validating

SRPM: libreoffice-3.4.6.2-0.1.mga1.src.rpm

Advisory:

An XML External Entity expansion flaw was found in the way Raptor
processed RDF files. If an application linked against Raptor were to
open a specially-crafted RDF file, it could possibly allow a remote
attacker to obtain a copy of an arbitrary local file that the user
running the application had access to. A bug in the way Raptor handled
external entities could cause that application to crash or, possibly,
execute arbitrary code with the privileges of the user running the
application (CVE-2012-0037).

libreoffice for Mageia 1 has been upgraded to the 3.4.6.2
version which is not vulnerable to this issue.

Reference: https://bugs.mageia.org/show_bug.cgi?id=5053

Could sysadmin please push from core/updates_testing to core/updates

Thanks!

Keywords: (none) => validated_update
CC: (none) => sysadmin-bugs
Whiteboard: MGA1-32-OK => MGA1-32-OK MGA1-64-OK

Comment 14 Thomas Backlund 2012-06-27 00:02:56 CEST
Update pushed:
https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0124

Status: NEW => RESOLVED
CC: (none) => tmb
Resolution: (none) => FIXED


Note You need to log in before you can comment on or make changes to this bug.