OpenOffice WMF/EMF文件处理堆溢出漏洞

2007-01-17T00:00:00
ID SSV:1203
Type seebug
Reporter Root
Modified 2007-01-17T00:00:00

Description

OpenOffice是个整合性的软件,包含了许多文字处理、表格、公式等办公工具。

OpenOffice在处理META_ESCAPE记录时存在截尾错误。在svtools\source\filter.vcl\wmf\winwmf.cxx文件中:

case W_META_ESCAPE : ... sal_uInt32 i, nStringLen, nDXCount; ... aMemoryStream >> aPt.X() >> aPt.Y() >> nStringLen;

sal_Unicode* pBuf = aString.AllocBuffer( (sal_uInt16)nStringLen ); for ( i = 0; i < nStringLen; i++ ) aMemoryStream >> pBuf[ i ];

nStringLen为sal_uInt32,被放到了sal_uInt16进行分配然后将最初的32位值用作了计数填充缓冲区,因此任何大于0xFFFF的长度都可能导致堆溢出。如果用户受骗打开了恶意的WMF文件或嵌入了该文件的文档(如Microsoft Word文档)的话,就可能导致通过覆盖函数指针或DWORD执行任意代码。

OpenOffice在处理EMR_POLYPOLYGON和EMR_POLYPOLYGON16记录时还存在整数溢出。在svtools\source\filter.vcl\wmf\enhwmf.cxx文件中:

case EMR_POLYPOLYGON :

INT32 i, nPoly, nGesPoints; ... pWMF >> nPoly >> nGesPoints; ... pPtAry = (Point) new char[ nGesPoints * sizeof(Point) ];

for ( i = 0; i < nGesPoints; i++ ) { *pWMF >> nX32 >> nY32; pPtAry[ i ] = Point( nX32, nY32 ); }

如果nGesPoints > (0x100000000/sizeof(Point))的话,nGesPoints * sizeof(Point)就会导致整数环绕。EMR_POLYPOLYGON16记录的情况与上述例子类似。远程攻击者可以通过诱骗用户打开恶意的WMF/EMF文件触发堆溢出,导致执行任意代码。

Sun StarOffice 8.0 Sun StarOffice 7.0 Sun StarOffice 6.0 OpenOffice OpenOffice 2.1 Debian


Debian已经为此发布了一个安全公告(DSA-1246-1)以及相应补丁: DSA-1246-1:New OpenOffice.org packages fix arbitrary code execution 链接:<a href="http://www.debian.org/security/2005/dsa-1246" target="_blank">http://www.debian.org/security/2005/dsa-1246</a>

补丁下载:

Source archives:

<a href="http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org_1.1.3-9sarge4.dsc" target="_blank">http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org_1.1.3-9sarge4.dsc</a> Size/MD5 checksum: 2878 3adfe8b09c20248767fe9d995b3f184c <a href="http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org_1.1.3-9sarge4.diff.gz" target="_blank">http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org_1.1.3-9sarge4.diff.gz</a> Size/MD5 checksum: 4623655 108120f3b365317fa9c47b25a5445fce <a href="http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org_1.1.3.orig.tar.gz" target="_blank">http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org_1.1.3.orig.tar.gz</a> Size/MD5 checksum: 166568714 5250574bad9906b38ce032d04b765772

Architecture independent components:

<a href="http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-af_1.1.3-9sarge4_all.deb" target="_blank">http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-af_1.1.3-9sarge4_all.deb</a> Size/MD5 checksum: 2647376 8704f95d7e844e302abcae4d403f7818 <a href="http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-ar_1.1.3-9sarge4_all.deb" target="_blank">http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-ar_1.1.3-9sarge4_all.deb</a> Size/MD5 checksum: 2694806 89cc4671d9d38ff05e5a361a06e02098 <a href="http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-ca_1.1.3-9sarge4_all.deb" target="_blank">http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-ca_1.1.3-9sarge4_all.deb</a> Size/MD5 checksum: 2690164 45db102838292106429d06f2c9d4a77f <a href="http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-cs_1.1.3-9sarge4_all.deb" target="_blank">http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-cs_1.1.3-9sarge4_all.deb</a> Size/MD5 checksum: 3586142 03e0e6ba4d7abc4954fb7ffe4e04ced6 <a href="http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-cy_1.1.3-9sarge4_all.deb" target="_blank">http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-cy_1.1.3-9sarge4_all.deb</a> Size/MD5 checksum: 2662654 ff77cf34ec2cfc0d8deaa49edf5ed00f <a href="http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-da_1.1.3-9sarge4_all.deb" target="_blank">http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-da_1.1.3-9sarge4_all.deb</a> Size/MD5 checksum: 3581922 7f69ac15b11613a649a2a08ff1501fd8 <a href="http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-de_1.1.3-9sarge4_all.deb" target="_blank">http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-de_1.1.3-9sarge4_all.deb</a> Size/MD5 checksum: 3453208 fcd76abbb9df7cd707e36903e9db1f17 <a href="http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-el_1.1.3-9sarge4_all.deb" target="_blank">http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-el_1.1.3-9sarge4_all.deb</a> Size/MD5 checksum: 2741468 ab08c03a0f0d78c3db9c99bd80fe12f1 <a href="http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-en_1.1.3-9sarge4_all.deb" target="_blank">http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-en_1.1.3-9sarge4_all.deb</a> Size/MD5 checksum: 3525792 12c71a26f9512295ab442fb63e8711a3 <a href="http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-es_1.1.3-9sarge4_all.deb" target="_blank">http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-es_1.1.3-9sarge4_all.deb</a> Size/MD5 checksum: 3560792 9965231fb1b0c3956ddb09255b91c86b <a href="http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-et_1.1.3-9sarge4_all.deb" target="_blank">http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-et_1.1.3-9sarge4_all.deb</a> Size/MD5 checksum: 2645014 baa0a0c809a740273d8dfd87b946d81b <a href="http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-eu_1.1.3-9sarge4_all.deb" target="_blank">http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-eu_1.1.3-9sarge4_all.deb</a> Size/MD5 checksum: 2667748 740c781dd55cad46fdc52c1926d5854e <a href="http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-fi_1.1.3-9sarge4_all.deb" target="_blank">http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-fi_1.1.3-9sarge4_all.deb</a> Size/MD5 checksum: 2673164 f8b2c8d335490dcaaf3f1bcb63eb72ec <a href="http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-fr_1.1.3-9sarge4_all.deb" target="_blank">http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-fr_1.1.3-9sarge4_all.deb</a> Size/MD5 checksum: 3494058 674365c474453cf6590a82c2b2d3d631 <a href="http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-gl_1.1.3-9sarge4_all.deb" target="_blank">http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-gl_1.1.3-9sarge4_all.deb</a> Size/MD5 checksum: 2657584 7ce93bcb8f34a3f05f7560b5631a5ed8 <a href="http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-he_1.1.3-9sarge4_all.deb" target="_blank">http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-he_1.1.3-9sarge4_all.deb</a> Size/MD5 checksum: 2659220 0eb0857819464be35dd9d7c81beaa0b5 <a href="http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-hi_1.1.3-9sarge4_all.deb" target="_blank">http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-hi_1.1.3-9sarge4_all.deb</a> Size/MD5 checksum: 2695686 3ca8a13e1d82d3036a92606bdce79b16 <a href="http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-hu_1.1.3-9sarge4_all.deb" target="_blank">http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-hu_1.1.3-9sarge4_all.deb</a> Size/MD5 checksum: 2771502 836d91201b70e5747a8099f5a5517deb <a href="http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-it_1.1.3-9sarge4_all.deb" target="_blank">http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-it_1.1.3-9sarge4_all.deb</a> Size/MD5 checksum: 3555644 3f3f0518c84cc9a7e191c6e025c67dcd <a href="http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-ja_1.1.3-9sarge4_all.deb" target="_blank">http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-ja_1.1.3-9sarge4_all.deb</a> Size/MD5 checksum: 3564244 80fc0de1fc7d84360091e53bdca22853 <a href="http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-kn_1.1.3-9sarge4_all.deb" target="_blank">http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-kn_1.1.3-9sarge4_all.deb</a> Size/MD5 checksum: 2685084 7c5fb3784626924e0c0ce5149191c5f7 <a href="http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-ko_1.1.3-9sarge4_all.deb" target="_blank">http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-ko_1.1.3-9sarge4_all.deb</a> Size/MD5 checksum: 3540114 4c9bed5f7bcea97d3ab3b117640c626d <a href="http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-lt_1.1.3-9sarge4_all.deb" target="_blank">http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-lt_1.1.3-9sarge4_all.deb</a> Size/MD5 checksum: 2672762 3778280d7eca49a1fbcd401750530fcc <a href="http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-nb_1.1.3-9sarge4_all.deb" target="_blank">http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-nb_1.1.3-9sarge4_all.deb</a> Size/MD5 checksum: 2663808 d69aa15d7e5ecece8ee1fef8efde0341 <a href="http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-nl_1.1.3-9sarge4_all.deb" target="_blank">http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-nl_1.1.3-9sarge4_all.deb</a> Size/MD5 checksum: 3559972 5f2d3ecab6bb697e66ee82b4e31d7bc0 <a href="http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-nn_1.1.3-9sarge4_all.deb" target="_blank">http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-nn_1.1.3-9sarge4_all.deb</a> Size/MD5 checksum: 2663552 2c1645edd72ca4ee2b6721848b3b360e <a href="http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-ns_1.1.3-9sarge4_all.deb" target="_blank">http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-ns_1.1.3-9sarge4_all.deb</a> Size/MD5 checksum: 2664676 5d3d924327b847377da15e74dbf70877 <a href="http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-pl_1.1.3-9sarge4_all.deb" target="_blank">http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-pl_1.1.3-9sarge4_all.deb</a> Size/MD5 checksum: 3238860 fcbda1d9de3fc009fa663319b91e2a3a <a href="http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-pt-br_1.1.3-9sarge4_all.deb" target="_blank">http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-pt-br_1.1.3-9sarge4_all.deb</a> Size/MD5 checksum: 3526050 966acfd1ae82a776bdb4f23108600225 <a href="http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-pt_1.1.3-9sarge4_all.deb" target="_blank">http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-pt_1.1.3-9sarge4_all.deb</a> Size/MD5 checksum: 3161406 d4d4fd2f3e77c5586e30f2f875dc33c3 <a href="http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-ru_1.1.3-9sarge4_all.deb" target="_blank">http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-ru_1.1.3-9sarge4_all.deb</a> Size/MD5 checksum: 3332148 55aca35c906a10915e053988b7aa3c09 <a href="http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-sk_1.1.3-9sarge4_all.deb" target="_blank">http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-sk_1.1.3-9sarge4_all.deb</a> Size/MD5 checksum: 3603192 2788a27445e52e81917364aba2a85c0a <a href="http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-sl_1.1.3-9sarge4_all.deb" target="_blank">http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-sl_1.1.3-9sarge4_all.deb</a> Size/MD5 checksum: 3599238 29ba9e01fb897c1287af13a4c478aeda <a href="http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-sv_1.1.3-9sarge4_all.deb" target="_blank">http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-sv_1.1.3-9sarge4_all.deb</a> Size/MD5 checksum: 3542822 665126a7f85234beb95d648e20534027 <a href="http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-th_1.1.3-9sarge4_all.deb" target="_blank">http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-th_1.1.3-9sarge4_all.deb</a> Size/MD5 checksum: 2689084 ac5b2a0123d8631a182a7de77e63ccf9 <a href="http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-tn_1.1.3-9sarge4_all.deb" target="_blank">http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-tn_1.1.3-9sarge4_all.deb</a> Size/MD5 checksum: 2650990 be8c4d81ccad1cc9951395fdf7ff078b <a href="http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-tr_1.1.3-9sarge4_all.deb" target="_blank">http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-tr_1.1.3-9sarge4_all.deb</a> Size/MD5 checksum: 2893818 488f3310417ade7cff1b013f7e0d5e82 <a href="http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-zh-cn_1.1.3-9sarge4_all.deb" target="_blank">http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-zh-cn_1.1.3-9sarge4_all.deb</a> Size/MD5 checksum: 3553030 9cd6554701566bc264cc479452b0dcd4 <a href="http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-zh-tw_1.1.3-9sarge4_all.deb" target="_blank">http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-zh-tw_1.1.3-9sarge4_all.deb</a> Size/MD5 checksum: 3548654 e7992921765ffc14f8d212799addb02f <a href="http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-zu_1.1.3-9sarge4_all.deb" target="_blank">http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-l10n-zu_1.1.3-9sarge4_all.deb</a> Size/MD5 checksum: 2672242 635031d8e6cc4b7c16f3eefad4edb05f <a href="http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-mimelnk_1.1.3-9sarge4_all.deb" target="_blank">http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-mimelnk_1.1.3-9sarge4_all.deb</a> Size/MD5 checksum: 67184 e44a08734ab212bdbc017f9675dff986 <a href="http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-thesaurus-en-us_1.1.3-9sarge4_all.deb" target="_blank">http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-thesaurus-en-us_1.1.3-9sarge4_all.deb</a> Size/MD5 checksum: 3130960 d659b041a6f58679cf05a67de068b6f3 <a href="http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org_1.1.3-9sarge4_all.deb" target="_blank">http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org_1.1.3-9sarge4_all.deb</a> Size/MD5 checksum: 6852620 9b1363c6d3e7395595687112f6632a36 <a href="http://security.debian.org/pool/updates/main/o/openoffice.org/ttf-opensymbol_1.1.3-9sarge4_all.deb" target="_blank">http://security.debian.org/pool/updates/main/o/openoffice.org/ttf-opensymbol_1.1.3-9sarge4_all.deb</a> Size/MD5 checksum: 137130 89898024ed9949ede2af7df7a907857b

Intel IA-32 architecture:

<a href="http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-bin_1.1.3-9sarge4_i386.deb" target="_blank">http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-bin_1.1.3-9sarge4_i386.deb</a> Size/MD5 checksum: 41473164 201d3654e0f25c09cad426a834a6a732 <a href="http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-dev_1.1.3-9sarge4_i386.deb" target="_blank">http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-dev_1.1.3-9sarge4_i386.deb</a> Size/MD5 checksum: 1858664 17e895e4db8a124105597bd091fe77db <a href="http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-evolution_1.1.3-9sarge4_i386.deb" target="_blank">http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-evolution_1.1.3-9sarge4_i386.deb</a> Size/MD5 checksum: 164568 dd1b783a99d9d7e08fa7d0f3707cdf16 <a href="http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-gtk-gnome_1.1.3-9sarge4_i386.deb" target="_blank">http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-gtk-gnome_1.1.3-9sarge4_i386.deb</a> Size/MD5 checksum: 160158 12e000d7418c4c79540cb0dabdf73c31 <a href="http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-kde_1.1.3-9sarge4_i386.deb" target="_blank">http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-kde_1.1.3-9sarge4_i386.deb</a> Size/MD5 checksum: 144160 efafeabb9e208f32dcd4d930f022453e

PowerPC architecture:

<a href="http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-bin_1.1.3-9sarge4_powerpc.deb" target="_blank">http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-bin_1.1.3-9sarge4_powerpc.deb</a> Size/MD5 checksum: 39929314 f47ffa291dc5e5423ad286da20780fa0 <a href="http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-dev_1.1.3-9sarge4_powerpc.deb" target="_blank">http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-dev_1.1.3-9sarge4_powerpc.deb</a> Size/MD5 checksum: 1865702 af0983cce9e7f71bfa36445eb525c8be <a href="http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-evolution_1.1.3-9sarge4_powerpc.deb" target="_blank">http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-evolution_1.1.3-9sarge4_powerpc.deb</a> Size/MD5 checksum: 161596 ddba4d76fed158c9c4c0441e0de71647 <a href="http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-gtk-gnome_1.1.3-9sarge4_powerpc.deb" target="_blank">http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-gtk-gnome_1.1.3-9sarge4_powerpc.deb</a> Size/MD5 checksum: 158824 e50a700f00a8fb92ddaf554fe3cc6fdd <a href="http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-kde_1.1.3-9sarge4_powerpc.deb" target="_blank">http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-kde_1.1.3-9sarge4_powerpc.deb</a> Size/MD5 checksum: 142330 8746389ad88f5176a6db6b75c0c503cb

IBM S/390 architecture:

<a href="http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-bin_1.1.3-9sarge4_s390.deb" target="_blank">http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-bin_1.1.3-9sarge4_s390.deb</a> Size/MD5 checksum: 42751682 c5b8173b85bf0f0931c98c2f204a5c05 <a href="http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-dev_1.1.3-9sarge4_s390.deb" target="_blank">http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-dev_1.1.3-9sarge4_s390.deb</a> Size/MD5 checksum: 1852730 18d41fcb730e667b6eaeb600dd36a1b5 <a href="http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-evolution_1.1.3-9sarge4_s390.deb" target="_blank">http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-evolution_1.1.3-9sarge4_s390.deb</a> Size/MD5 checksum: 166852 0122761ef0c613aa3f64f7e6685a7311 <a href="http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-gtk-gnome_1.1.3-9sarge4_s390.deb" target="_blank">http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-gtk-gnome_1.1.3-9sarge4_s390.deb</a> Size/MD5 checksum: 166716 c70e54ac2a1ab5c4b23fb017128db5ec <a href="http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-kde_1.1.3-9sarge4_s390.deb" target="_blank">http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-kde_1.1.3-9sarge4_s390.deb</a> Size/MD5 checksum: 145354 fec4c419919354ae32c114563c8b6390

Sun Sparc architecture:

<a href="http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-bin_1.1.3-9sarge4_sparc.deb" target="_blank">http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-bin_1.1.3-9sarge4_sparc.deb</a> Size/MD5 checksum: 40804144 3f6d727294d3992769146240bb532e69 <a href="http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-dev_1.1.3-9sarge4_sparc.deb" target="_blank">http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-dev_1.1.3-9sarge4_sparc.deb</a> Size/MD5 checksum: 1847714 7d50650e99e42aa2f0da81493b862274 <a href="http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-evolution_1.1.3-9sarge4_sparc.deb" target="_blank">http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-evolution_1.1.3-9sarge4_sparc.deb</a> Size/MD5 checksum: 168000 b703ad63b11459d7062517a7cbb1b776 <a href="http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-gtk-gnome_1.1.3-9sarge4_sparc.deb" target="_blank">http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-gtk-gnome_1.1.3-9sarge4_sparc.deb</a> Size/MD5 checksum: 158394 e2ec76119983f45320a3d2aa5b9112f4 <a href="http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-kde_1.1.3-9sarge4_sparc.deb" target="_blank">http://security.debian.org/pool/updates/main/o/openoffice.org/openoffice.org-kde_1.1.3-9sarge4_sparc.deb</a> Size/MD5 checksum: 139900 e7b6f94dabdbe6ac98b9e22d8425c27c

补丁安装方法:

  1. 手工安装补丁包:

首先,使用下面的命令来下载补丁软件: # wget url (url是补丁下载链接地址)

然后,使用下面的命令来安装补丁:
# dpkg -i file.deb (file是相应的补丁名)

  1. 使用apt-get自动安装补丁包:

首先,使用下面的命令更新内部数据库: # apt-get update

然后,使用下面的命令安装更新软件包: # apt-get upgrade

RedHat

RedHat已经为此发布了一个安全公告(RHSA-2007:0001-01)以及相应补丁: RHSA-2007:0001-01:Important: openoffice.org security update 链接:<a href="http://lwn.net/Alerts/216323/?format=printable" target="_blank">http://lwn.net/Alerts/216323/?format=printable</a>

Sun

Sun已经为此发布了一个安全公告(Sun-Alert-102735)以及相应补丁: Sun-Alert-102735:Security Vulnerability With StarOffice/StarSuite Versions 6, 7 and 8 Related to the '.wmf' File Format 链接:<a href="http://sunsolve.sun.com/search/printfriendly.do?assetkey=1-26-102735-1" target="_blank">http://sunsolve.sun.com/search/printfriendly.do?assetkey=1-26-102735-1</a>

Gentoo

Gentoo已经为此发布了一个安全公告(GLSA-200701-07)以及相应补丁: GLSA-200701-07:OpenOffice.org: EMF/WMF file handling vulnerabilities 链接:<a href="http://security.gentoo.org/glsa/glsa-200701-07.xml" target="_blank">http://security.gentoo.org/glsa/glsa-200701-07.xml</a>

所有OpenOffice.org二进制程序用户都应升级到2.1.0或之后版本:

# emerge --sync
# emerge --ask --oneshot --verbose &quot;&gt;=app-office/openoffice-bin-2.1.0&quot;

所有OpenOffice.org用户都应升级到2.0.4或之后版本:

# emerge --sync
# emerge --ask --oneshot --verbose &quot;&gt;=app-office/openoffice-2.0.4&quot;

OpenOffice

目前厂商已经发布了升级补丁以修复这个安全问题,请到厂商的主页下载:

<a href="http://download.openoffice.org/2.1.0/index.html" target="_blank">http://download.openoffice.org/2.1.0/index.html</a>