The Document Foundation (TDF) announces LibreOffice 3.4.6, solving a potential security problem and a number of bugs of the program. http://libreoffice.ut.ee/libreoffice/src/bugfixes-libreoffice-3-4-6-release-3.4.6.1.log http://download.documentfoundation.org/libreoffice/src/bugfixes-libreoffice-3-4-6-release-3.4.6.2.log
i will update our mga 1 to it.
Mandriva has updated MDV 2011 to 3.4.6 this morning: http://www.mandriva.com/en/support/security/advisories/?dis=2011&name=MDVSA-2012:063 I think it would nice to have, but I'm not sure about the security issue. The issue is in the raptor library. I know LO includes its own copy of it, but I think our package isn't actually using it, but is instead using the system one. It's not linked to it directly, but it is linked to librdf which is linked to libraptor, and I read a mail on the full disclosure mailing list yesterday which said that's how LO uses raptor: through librdf.
CC: (none) => luigiwalser
There's another security issue that may impact us: CVE-2012-1149. See https://bugzilla.redhat.com/show_bug.cgi?id=821726
Also CVE-2012-2334. See https://bugzilla.redhat.com/show_bug.cgi?id=821803
3.4.6.2 is now in testing. please test.
(In reply to comment #5) > 3.4.6.2 is now in testing. please test. Looks like it's still building. Hopefully it succeeds this time :o) I see you also built 3.5.5.1 for Mageia 2. Are you filing a bug for that one?
no, i will for 3.5.5 final ( 3.5.5.1 is the rc1 ) i uploaded for tests and to see if it fixed bugs ( and yes :D ). see http://wiki.documentfoundation.org/ReleasePlan#3.5_release 3.5.5 should be available in 2 weeks ( at this moment i will do a bugreport ;) )
Ahh, sounds good. Thanks D Morgan. BTW, do we have an advisory for this one? Here's the packages that were built. libreoffice-3.4.6.2-0.1.mga1 libreoffice-core-3.4.6.2-0.1.mga1 libreoffice-pyuno-3.4.6.2-0.1.mga1 libreoffice-base-3.4.6.2-0.1.mga1 libreoffice-report-builder-3.4.6.2-0.1.mga1 libreoffice-bsh-3.4.6.2-0.1.mga1 libreoffice-rhino-3.4.6.2-0.1.mga1 libreoffice-wiki-publisher-3.4.6.2-0.1.mga1 libreoffice-ogltrans-3.4.6.2-0.1.mga1 libreoffice-presentation-minimizer-3.4.6.2-0.1.mga1 libreoffice-presenter-screen-3.4.6.2-0.1.mga1 libreoffice-pdfimport-3.4.6.2-0.1.mga1 libreoffice-opensymbol-fonts-3.4.6.2-0.1.mga1 libreoffice-writer-3.4.6.2-0.1.mga1 libreoffice-emailmerge-3.4.6.2-0.1.mga1 libreoffice-calc-3.4.6.2-0.1.mga1 libreoffice-draw-3.4.6.2-0.1.mga1 libreoffice-impress-3.4.6.2-0.1.mga1 libreoffice-math-3.4.6.2-0.1.mga1 libreoffice-graphicfilter-3.4.6.2-0.1.mga1 libreoffice-xsltfilter-3.4.6.2-0.1.mga1 libreoffice-javafilter-3.4.6.2-0.1.mga1 libreoffice-testtools-3.4.6.2-0.1.mga1 libreoffice-ure-3.4.6.2-0.1.mga1 libreoffice-java-common-3.4.6.2-0.1.mga1 libreoffice-sdk-3.4.6.2-0.1.mga1 libreoffice-sdk-doc-3.4.6.2-0.1.mga1 libreoffice-headless-3.4.6.2-0.1.mga1 libreoffice-kde-3.4.6.2-0.1.mga1 libreoffice-debug-3.4.6.2-0.1.mga1 libreoffice-gdb-debug-support-3.4.6.2-0.1.mga1 libreoffice-langpack-af-3.4.6.2-0.1.mga1 libreoffice-langpack-ar-3.4.6.2-0.1.mga1 libreoffice-langpack-as-3.4.6.2-0.1.mga1 libreoffice-langpack-bg-3.4.6.2-0.1.mga1 libreoffice-langpack-bn-3.4.6.2-0.1.mga1 libreoffice-langpack-ca-3.4.6.2-0.1.mga1 libreoffice-langpack-cs-3.4.6.2-0.1.mga1 libreoffice-langpack-cy-3.4.6.2-0.1.mga1 libreoffice-langpack-da-3.4.6.2-0.1.mga1 libreoffice-langpack-de-3.4.6.2-0.1.mga1 libreoffice-langpack-dz-3.4.6.2-0.1.mga1 libreoffice-langpack-el-3.4.6.2-0.1.mga1 libreoffice-langpack-en-3.4.6.2-0.1.mga1 libreoffice-langpack-es-3.4.6.2-0.1.mga1 libreoffice-langpack-et-3.4.6.2-0.1.mga1 libreoffice-langpack-eu-3.4.6.2-0.1.mga1 libreoffice-langpack-fi-3.4.6.2-0.1.mga1 libreoffice-langpack-fr-3.4.6.2-0.1.mga1 libreoffice-langpack-ga-3.4.6.2-0.1.mga1 libreoffice-langpack-gl-3.4.6.2-0.1.mga1 libreoffice-langpack-gu-3.4.6.2-0.1.mga1 libreoffice-langpack-he-3.4.6.2-0.1.mga1 libreoffice-langpack-hi-3.4.6.2-0.1.mga1 libreoffice-langpack-hr-3.4.6.2-0.1.mga1 libreoffice-langpack-hu-3.4.6.2-0.1.mga1 libreoffice-langpack-it-3.4.6.2-0.1.mga1 libreoffice-langpack-ja-3.4.6.2-0.1.mga1 libreoffice-langpack-kn-3.4.6.2-0.1.mga1 libreoffice-langpack-ko-3.4.6.2-0.1.mga1 libreoffice-langpack-lt-3.4.6.2-0.1.mga1 libreoffice-langpack-mai-3.4.6.2-0.1.mga1 libreoffice-langpack-ml-3.4.6.2-0.1.mga1 libreoffice-langpack-mr-3.4.6.2-0.1.mga1 libreoffice-langpack-nb-3.4.6.2-0.1.mga1 libreoffice-langpack-nl-3.4.6.2-0.1.mga1 libreoffice-langpack-nn-3.4.6.2-0.1.mga1 libreoffice-langpack-nr-3.4.6.2-0.1.mga1 libreoffice-langpack-nso-3.4.6.2-0.1.mga1 libreoffice-langpack-or-3.4.6.2-0.1.mga1 libreoffice-langpack-pa-3.4.6.2-0.1.mga1 libreoffice-langpack-pl-3.4.6.2-0.1.mga1 libreoffice-langpack-pt-BR-3.4.6.2-0.1.mga1 libreoffice-langpack-pt-PT-3.4.6.2-0.1.mga1 libreoffice-langpack-ro-3.4.6.2-0.1.mga1 libreoffice-langpack-ru-3.4.6.2-0.1.mga1 libreoffice-langpack-si-3.4.6.2-0.1.mga1 libreoffice-langpack-sk-3.4.6.2-0.1.mga1 libreoffice-langpack-sl-3.4.6.2-0.1.mga1 libreoffice-langpack-sr-3.4.6.2-0.1.mga1 libreoffice-langpack-ss-3.4.6.2-0.1.mga1 libreoffice-langpack-st-3.4.6.2-0.1.mga1 libreoffice-langpack-sv-3.4.6.2-0.1.mga1 libreoffice-langpack-ta-3.4.6.2-0.1.mga1 libreoffice-langpack-te-3.4.6.2-0.1.mga1 libreoffice-langpack-th-3.4.6.2-0.1.mga1 libreoffice-langpack-tn-3.4.6.2-0.1.mga1 libreoffice-langpack-tr-3.4.6.2-0.1.mga1 libreoffice-langpack-ts-3.4.6.2-0.1.mga1 libreoffice-langpack-uk-3.4.6.2-0.1.mga1 libreoffice-langpack-ve-3.4.6.2-0.1.mga1 libreoffice-langpack-xh-3.4.6.2-0.1.mga1 libreoffice-langpack-zh_CN-3.4.6.2-0.1.mga1 libreoffice-langpack-zh_TW-3.4.6.2-0.1.mga1 libreoffice-langpack-zu-3.4.6.2-0.1.mga1 autocorr-en-3.4.6.2-0.1.mga1 autocorr-af-3.4.6.2-0.1.mga1 autocorr-bg-3.4.6.2-0.1.mga1 autocorr-cs-3.4.6.2-0.1.mga1 autocorr-da-3.4.6.2-0.1.mga1 autocorr-de-3.4.6.2-0.1.mga1 autocorr-es-3.4.6.2-0.1.mga1 autocorr-eu-3.4.6.2-0.1.mga1 autocorr-fa-3.4.6.2-0.1.mga1 autocorr-fi-3.4.6.2-0.1.mga1 autocorr-fr-3.4.6.2-0.1.mga1 autocorr-ga-3.4.6.2-0.1.mga1 autocorr-hr-3.4.6.2-0.1.mga1 autocorr-hu-3.4.6.2-0.1.mga1 autocorr-it-3.4.6.2-0.1.mga1 autocorr-ja-3.4.6.2-0.1.mga1 autocorr-ko-3.4.6.2-0.1.mga1 autocorr-lb-3.4.6.2-0.1.mga1 autocorr-lt-3.4.6.2-0.1.mga1 autocorr-mn-3.4.6.2-0.1.mga1 autocorr-nl-3.4.6.2-0.1.mga1 autocorr-pl-3.4.6.2-0.1.mga1 autocorr-pt-3.4.6.2-0.1.mga1 autocorr-ru-3.4.6.2-0.1.mga1 autocorr-sk-3.4.6.2-0.1.mga1 autocorr-sl-3.4.6.2-0.1.mga1 autocorr-sr-3.4.6.2-0.1.mga1 autocorr-sv-3.4.6.2-0.1.mga1 autocorr-tr-3.4.6.2-0.1.mga1 autocorr-vi-3.4.6.2-0.1.mga1 autocorr-zh-3.4.6.2-0.1.mga1 libreoffice-help-en-3.4.6.2-0.1.mga1 libreoffice-help-bg-3.4.6.2-0.1.mga1 libreoffice-help-bn-3.4.6.2-0.1.mga1 libreoffice-help-ca-3.4.6.2-0.1.mga1 libreoffice-help-cs-3.4.6.2-0.1.mga1 libreoffice-help-da-3.4.6.2-0.1.mga1 libreoffice-help-de-3.4.6.2-0.1.mga1 libreoffice-help-dz-3.4.6.2-0.1.mga1 libreoffice-help-el-3.4.6.2-0.1.mga1 libreoffice-help-es-3.4.6.2-0.1.mga1 libreoffice-help-et-3.4.6.2-0.1.mga1 libreoffice-help-eu-3.4.6.2-0.1.mga1 libreoffice-help-fi-3.4.6.2-0.1.mga1 libreoffice-help-fr-3.4.6.2-0.1.mga1 libreoffice-help-gl-3.4.6.2-0.1.mga1 libreoffice-help-hi-3.4.6.2-0.1.mga1 libreoffice-help-hu-3.4.6.2-0.1.mga1 libreoffice-help-it-3.4.6.2-0.1.mga1 libreoffice-help-ja-3.4.6.2-0.1.mga1 libreoffice-help-ko-3.4.6.2-0.1.mga1 libreoffice-help-nb-3.4.6.2-0.1.mga1 libreoffice-help-nl-3.4.6.2-0.1.mga1 libreoffice-help-nn-3.4.6.2-0.1.mga1 libreoffice-help-pl-3.4.6.2-0.1.mga1 libreoffice-help-pt_BR-3.4.6.2-0.1.mga1 libreoffice-help-pt-3.4.6.2-0.1.mga1 libreoffice-help-ru-3.4.6.2-0.1.mga1 libreoffice-help-si-3.4.6.2-0.1.mga1 libreoffice-help-sk-3.4.6.2-0.1.mga1 libreoffice-help-sl-3.4.6.2-0.1.mga1 libreoffice-help-sv-3.4.6.2-0.1.mga1 libreoffice-help-tr-3.4.6.2-0.1.mga1 libreoffice-help-uk-3.4.6.2-0.1.mga1 libreoffice-help-zh_CN-3.4.6.2-0.1.mga1 libreoffice-help-zh_TW-3.4.6.2-0.1.mga1 from libreoffice-3.4.6.2-0.1.mga1.src.rpm
CC: (none) => dmorganecAssignee: dmorganec => qa-bugs
Advisory: An XML External Entity expansion flaw was found in the way Raptor processed RDF files. If an application linked against Raptor were to open a specially-crafted RDF file, it could possibly allow a remote attacker to obtain a copy of an arbitrary local file that the user running the application had access to. A bug in the way Raptor handled external entities could cause that application to crash or, possibly, execute arbitrary code with the privileges of the user running the application (CVE-2012-0037). libreoffice for Mageia 1 has been upgraded to the 3.4.6.2 version which is not vulnerable to this issue. Reference: https://bugs.mageia.org/show_bug.cgi?id=5053
Testing i586 I haven't found an exploit although securityfocus says "An attacker can exploit this issue using readily available tools.". I guess we'll have to trust libreoffice to have fixed it properly in 3.4.6.2 and make sure this bugfix release doesn't introduce obvious regressions. So far, basic operations in writer, calc, impress work well.
CC: (none) => stormi
Testing complete i586 (but since this is libreoffice, other testers for i586 are welcome to help validating it deeply). I opened and saved various files, checked the automated spellchecking, it is correctly localized for my language. Only problem I had is it won't open a certain file of mine, but previous versions wouldn't either, so there's no regression here.
Whiteboard: (none) => MGA1-32-OK
can we see this update pushed then ?
Testing completed x86_64 Mageia 1 Validating SRPM: libreoffice-3.4.6.2-0.1.mga1.src.rpm Advisory: An XML External Entity expansion flaw was found in the way Raptor processed RDF files. If an application linked against Raptor were to open a specially-crafted RDF file, it could possibly allow a remote attacker to obtain a copy of an arbitrary local file that the user running the application had access to. A bug in the way Raptor handled external entities could cause that application to crash or, possibly, execute arbitrary code with the privileges of the user running the application (CVE-2012-0037). libreoffice for Mageia 1 has been upgraded to the 3.4.6.2 version which is not vulnerable to this issue. Reference: https://bugs.mageia.org/show_bug.cgi?id=5053 Could sysadmin please push from core/updates_testing to core/updates Thanks!
Keywords: (none) => validated_updateCC: (none) => sysadmin-bugsWhiteboard: MGA1-32-OK => MGA1-32-OK MGA1-64-OK
Update pushed: https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0124
Status: NEW => RESOLVEDCC: (none) => tmbResolution: (none) => FIXED