Vulnerability in OpenOffice

[K-9]

just saw this:


http://www.heise-online.co.uk/open/Vulnerability-in-OpenOffice--/news/111422

Vulnerability in OpenOffice

The current version of OpenOffice reportedly contains a security flaw that allows attackers to inject code into a system. The problem apparently only affects the 64-bit version of the office suite. No official patched version is currently available because the 64-bit binary releases only come from Linux distributors, not from developers.
The flaw has, however, already been remedied in the repositories of OpenOffice. Red Hat was one of the first distributors to publish new packages for 64-bit versions under RHEL Desktop Workstation V5 Client and Red Hat Enterprise Linux Desktop V5.
The vulnerability is the result of a flaw in the function rtl_allocateMemory on 64-bit systems; the function is designed to allow for access to memory outside of a defined array. The problem can reportedly be prevented during compilation by adding the option --with-alloc=system.

[Samwise]

NeoOfficce is not affected for two reasons:

- NeoOffice is only released in 32-bit "flavor";

- more importantly, NeoOffice doesn't use the OpenOffice.org memory allocation code which is affected by the flaw (IIRC);

[K-9]

Ok - I had no clue but I figured I'd post it just in case... if you want - delete this thread please.