Posted: Mon Dec 08, 2003 9:45 am Post subject: Warning about secutiy update 1.0 for 10.2.8
The Security update for 10.2.8 updates many functions including the following:
"zlib: Addresses CAN-2003-0107. While there were no functions in Mac
OS X that used the vulnerable gzprintf() function, the underlying
issue in zlib has been fixed to protect any third-party applications
that may potentially use this library."
I believe this is why I can't open window files anymore.
Still don't know how to fix this, but I thought I'd warn you.
Joined: May 25, 2003 Posts: 4752 Location: Santa Barbara, CA
Posted: Sat Dec 13, 2003 12:11 pm Post subject:
Hmm...I'm not sure if zlib would be the culprit. The way that OOo is compiled, it compiles its own version of zlib that it uses for only OOo. This should help to isolate it from underlying zlib changes in the security updates...but...OOo itself is still subject to the security advisories for the old zlib. As OOo is running in user-space, they shouldn't compromise overall system security.
Well, first of all I was on safari, and the autpmated security update came up and asked if I wanted it. So of course I want security. But ed, I'm new at this unix stuff, so to be honest, and I think it's obvios, I don't know what the hell I'm doing, just trying to learn. So After my frustration I just deleted all deletable files that was created that day, hoping I wouldn't have to reload my whole system. This somehow helped and I was able to open the word document I was trying to.
However, now the difference is that even though I didn't have the font, OOo was able to reproduce the correct one, but now an obsolete font is lost and another is replaced for it. i.e. Ohio for Ribbon.
Joined: May 25, 2003 Posts: 4752 Location: Santa Barbara, CA
Posted: Thu Dec 18, 2003 9:19 pm Post subject:
No worries dude, it's fine being new at this stuff...that's why I try to help supporting people Aside from the fact it did make me go back and review the zlib stuff too...I agree that users need security, and OOo especially. I know where I work we've got some sensitive documents that go around and wouldn't want anyone trying to insert a backdoor. The worst thing with security is that we've got so many programs on OS X, including some of the apps OOo depends on, that pop up the authentication dialog. A sign of a program wanting the ability to write things as root. There's stilll way too much of that going on.
But on a sidenote...as to the font replacement, check to see if you have that correct font in the directory /Applications/OpenOffice.org1.0.3/share/fonts/truetype/. If you do, then try deleting the /Applications/OpenOffice.org1.0.3/share/psprint/pspfontcache file and restarting OOo to rebuild the font list. If the font you need isn't in that truetype directory (apologies if I got the wrong one off the top of my head), you'll need to convert it...
1) Find it in /Library/Fonts (or wherever)
2) Drag it onto Start OpenOffice.org
3) This will produce a file ending in ".ttf" on your Desktop. Move the .ttf file into /Applications/OpenOffice.org1.0.3/share/fonts/truetype
4) Delete that pspfontcache file mentioned above
5) Restart OOo
Posted: Thu Jan 01, 2004 5:59 pm Post subject: That's not all...
Well...I had been editing a naovel with large graphics in jpeg. I have now gone back to it and OOo is opening it as a read only file. This was not the case before my security update.
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum You cannot attach files in this forum You cannot download files in this forum
Aside from the fact it did make me go back and review the zlib stuff too...I agree that users need security, and OOo especially. I know where I work we've got some sensitive documents that go around and wouldn't want anyone trying to insert a backdoor. The worst thing with security is that we've got so many programs on OS X, including some of the apps OOo depends on, that pop up the authentication dialog. A sign of a program wanting the ability to write things as root. There's stilll way too much of that going on.
