Ubuntu 11.10, 11.04 USN-1495-1 Moderate: LibreOffice Code Execution

ubuntu

July 3, 2012

LibreOffice could be made to crash or potentially run programs as your login if it opened a specially crafted file.

Summary

LibreOffice could be made to crash or potentially run programs as your

Software Description:

- libreoffice: Office productivity suite

- libreoffice-l10n: Office productivity suite help

Details:

Integer overflows were discovered in the graphics loading code of several

different image types. If a user were tricked into opening a specially

crafted file, an attacker could cause LibreOffice to crash or possibly

execute arbitrary code with the privileges of the user invoking the

program. (CVE-2012-1149)

Sven Jacobi discovered an integer overflow when processing Escher graphics

records. If a user were tricked into opening a specially crafted PowerPoint

file, an attacker could cause LibreOffice to crash or possibly execute

arbitrary code with the privileges of the user invoking the program.

(CVE-2012-2334)

Topics Covered

security advisory code execution moderate threat ubuntu libreoffice

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 11.10:
  libreoffice-core                1:3.4.4-0ubuntu1.2
  libreoffice-l10n-common         1:3.4.4-0ubuntu1.2

Ubuntu 11.04:
  libreoffice-core                1:3.3.4-0ubuntu1.2
  libreoffice-l10n-common         1:3.3.3-1ubuntu1.2

After a standard system update you need to restart LibreOffice to make all
the necessary changes.