Author: buildbot Date: Wed Nov 4 22:39:00 2015 New Revision: 971384 Log: Staging update by buildbot for ooo-site
Modified: websites/staging/ooo-site/trunk/cgi-bin/ (props changed) websites/staging/ooo-site/trunk/content/ (props changed) websites/staging/ooo-site/trunk/content/security/bulletin.html websites/staging/ooo-site/trunk/content/security/cves/CVE-2013-1571.html websites/staging/ooo-site/trunk/content/security/cves/CVE-2013-2189.html websites/staging/ooo-site/trunk/content/security/cves/CVE-2013-4156.html websites/staging/ooo-site/trunk/content/security/cves/CVE-2014-3524.html websites/staging/ooo-site/trunk/content/security/cves/CVE-2014-3575.html websites/staging/ooo-site/trunk/content/security/cves/CVE-2015-1774.html websites/staging/ooo-site/trunk/content/security/cves/CVE-2015-4551.html websites/staging/ooo-site/trunk/content/security/cves/CVE-2015-5212.html websites/staging/ooo-site/trunk/content/security/cves/CVE-2015-5213.html websites/staging/ooo-site/trunk/content/security/cves/CVE-2015-5214.html Propchange: websites/staging/ooo-site/trunk/cgi-bin/ ------------------------------------------------------------------------------ --- cms:source-revision (original) +++ cms:source-revision Wed Nov 4 22:39:00 2015 @@ -1 +1 @@ -1712674 +1712679 Propchange: websites/staging/ooo-site/trunk/content/ ------------------------------------------------------------------------------ --- cms:source-revision (original) +++ cms:source-revision Wed Nov 4 22:39:00 2015 @@ -1 +1 @@ -1712674 +1712679 Modified: websites/staging/ooo-site/trunk/content/security/bulletin.html ============================================================================== --- websites/staging/ooo-site/trunk/content/security/bulletin.html (original) +++ websites/staging/ooo-site/trunk/content/security/bulletin.html Wed Nov 4 22:39:00 2015 @@ -39,6 +39,7 @@ <h3>Fixed in Apache OpenOffice 4.1.2</h3> <ul> <li><a href="cves/CVE-2015-1774.html">CVE-2015-1774</a>: Out-of-Bounds Write in HWP File Filter</li> +<li><a href="cves/CVE-2015-4551.html">CVE-2015-4551</a>: Targeted Data Disclosure</li> <li><a href="cves/CVE-2015-5212.html">CVE-2015-5212</a>: ODF Printer Settings Vulnerability</li> <li><a href="cves/CVE-2015-5213.html">CVE-2015-5213</a>: .DOC Document Vulnerability</li> <li><a href="cves/CVE-2015-5214.html">CVE-2015-5214</a>: .DOC Bookmarks Vulnerability</li> Modified: websites/staging/ooo-site/trunk/content/security/cves/CVE-2013-1571.html ============================================================================== --- websites/staging/ooo-site/trunk/content/security/cves/CVE-2013-1571.html (original) +++ websites/staging/ooo-site/trunk/content/security/cves/CVE-2013-1571.html Wed Nov 4 22:39:00 2015 @@ -28,31 +28,31 @@ Frame Injection Vulnerability in SDK JavaDoc </h3> - <ul> - + <ul> + <h4>Severity: Medium</h4> <h4>Vendor: The Apache Software Foundation</h4> - + <h4>Versions Affected:</h4> <ul> <li>Apache OpenOffice 3.4.1 SDK, on all platforms.</li> <li>Earlier versions may be also affected.</li> </ul> - + <h4>Description:</h4> <p> As reported on June 18th there is a <a href="http://www.kb.cert.org/vuls/id/225657">vulnerability in JavaDoc</a> generated by Java 5, Java 6 and Java 7 before update 22. Generated - JavaDoc files could be suceptible to HTML frame injection attacks. Our investigation indicated that the UDK 3.2.7 Java API Reference in the Apache OpenOffice SDK contains + JavaDoc files could be suceptible to HTML frame injection attacks. Our investigation indicated that the UDK 3.2.7 Java API Reference in the Apache OpenOffice SDK contains a vulnerable HTML file.</p> <p>Note: Ordinary installs of OpenOffice are not impacted by this vulnerability. Only installs of the OpenOffice SDK, typically only installed by software developers writing extensions, are impacted</p> <h4>Mitigation</h4> - <p>SDK users should update their installations by replacing /docs/java/ref/index.html with this - <a href="http://archive.apache.org/dist/incubator/ooo/3.4.1/source/cve-2013-1571.zip">patched version</a>. + <p>SDK users should update their installations by replacing /docs/java/ref/index.html with this + <a href="http://archive.apache.org/dist/incubator/ooo/3.4.1/source/cve-2013-1571.zip">patched version</a>. Download, unzip and follow the instructions in the enclosed README file.</p> <p>Users with earlier versions of the SDK (pre 3.4.1) should <a href="http://www.download.openoffice.org/download/other.html#tested-sdk">upgrade to the current version</a> and then apply the patch. Alternative, they can download and run @@ -63,8 +63,8 @@ As reported on June 18th there is a <a h <h4>Verifying the Integrity of Downloaded Files</h4> <p> -We have provided <a href="http://archive.apache.org/dist/incubator/ooo/3.4.1/source/cve-2013-1571.zip.md5">MD5</a> and <a href="http://archive.apache.org/dist/incubator/ooo/3.4.1/source/cve-2013-1571.zip.sha256">SHA256</a> hashes of these patches, - as well as a <a href="http://archive.apache.org/dist/incubator/ooo/3.4.1/source/cve-2013-1571.zip.asc">GPG/PGP detached digital signature</a>, for those who wish to verify the +We have provided <a href="http://archive.apache.org/dist/incubator/ooo/3.4.1/source/cve-2013-1571.zip.md5">MD5</a> and <a href="http://archive.apache.org/dist/incubator/ooo/3.4.1/source/cve-2013-1571.zip.sha256">SHA256</a> hashes of these patches, + as well as a <a href="http://archive.apache.org/dist/incubator/ooo/3.4.1/source/cve-2013-1571.zip.asc">GPG/PGP detached digital signature</a>, for those who wish to verify the integrity of this file. <p> The MD5 and SHA256 hashes can be verified using Unix tools like md5sum or sha256sum. @@ -92,7 +92,7 @@ The PGP signatures can be verified using <hr /> - <p><a href="http://security.openoffice.org">Security Home</a> -> <a href="http://security.openoffice.org/bulletin.html">Bulletin</a> -> + <p><a href="http://security.openoffice.org">Security Home</a> -> <a href="http://security.openoffice.org/security/bulletin.html">Bulletin</a> -> <a href="http://security.openoffice.org/security/cves/CVE-2013-1571.html">CVE-2013-1571</a></p> </div> Modified: websites/staging/ooo-site/trunk/content/security/cves/CVE-2013-2189.html ============================================================================== --- websites/staging/ooo-site/trunk/content/security/cves/CVE-2013-2189.html (original) +++ websites/staging/ooo-site/trunk/content/security/cves/CVE-2013-2189.html Wed Nov 4 22:39:00 2015 @@ -3,8 +3,8 @@ <head> <link href="/css/ooo.css" rel="stylesheet" type="text/css"> - <title>CVE-2013-2189</title> - <style type="text/css"></style> + <title>CVE-2013-2189</title> + <style type="text/css"></style> <!--#include virtual="/google-analytics.js" --> <!--#include virtual="/scripts/entourage.js" --> @@ -22,36 +22,36 @@ - <h2><a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=2013-2189">CVE-2013-2189</a></h2> + <h2><a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=2013-2189">CVE-2013-2189</a></h2> - <h3>OpenOffice DOC Memory Corruption Vulnerability</h3> + <h3>OpenOffice DOC Memory Corruption Vulnerability</h3> - <ul> - <h4>Severity: Important</h4> - <h4>Vendor: The Apache Software Foundation</h4> - <h4>Versions Affected:</h4> - <ul> - <li>Apache OpenOffice 3.4.0 to 3.4.1, on all platforms.</li> - <li>Earlier versions may be also affected.</li> - </ul> - - <h4>Description:</h4> - <p>The vulnerability is caused by operating on invalid PLCF (Plex of Character Positions in File) data when parsing a malformed DOC document file. - Specially crafted documents can be used for denial-of-service attacks. - Further exploits are possible but have not been verified. - - <h4>Mitigation</h4> - <p>Apache OpenOffice 3.4 users are advised to <a href="http://download.openoffice.org">upgrade to Apache OpenOffice 4.0</a>. - Users who are unable to upgrade immediately should be cautious when opening untrusted documents. - - <h4>Credits</h4> - <p>The Apache OpenOffice security team credits Jeremy Brown of Microsoft Vulnerability Research as the discoverer of this flaw.</p> - - <hr /> - - <p><a href="http://security.openoffice.org">Security Home</a> - -> <a href="http://security.openoffice.org/bulletin.html">Bulletin</a> - -> <a href="http://security.openoffice.org/security/cves/CVE-2013-2189.html">CVE-2013-2189</a></p> + <ul> + <h4>Severity: Important</h4> + <h4>Vendor: The Apache Software Foundation</h4> + <h4>Versions Affected:</h4> + <ul> + <li>Apache OpenOffice 3.4.0 to 3.4.1, on all platforms.</li> + <li>Earlier versions may be also affected.</li> + </ul> + + <h4>Description:</h4> + <p>The vulnerability is caused by operating on invalid PLCF (Plex of Character Positions in File) data when parsing a malformed DOC document file. + Specially crafted documents can be used for denial-of-service attacks. + Further exploits are possible but have not been verified. + + <h4>Mitigation</h4> + <p>Apache OpenOffice 3.4 users are advised to <a href="http://download.openoffice.org">upgrade to Apache OpenOffice 4.0</a>. + Users who are unable to upgrade immediately should be cautious when opening untrusted documents. + + <h4>Credits</h4> + <p>The Apache OpenOffice security team credits Jeremy Brown of Microsoft Vulnerability Research as the discoverer of this flaw.</p> + + <hr /> + + <p><a href="http://security.openoffice.org">Security Home</a> + -> <a href="http://security.openoffice.org/security/bulletin.html">Bulletin</a> + -> <a href="http://security.openoffice.org/security/cves/CVE-2013-2189.html">CVE-2013-2189</a></p> </div> <!--#include virtual="/footer.html" --> Modified: websites/staging/ooo-site/trunk/content/security/cves/CVE-2013-4156.html ============================================================================== --- websites/staging/ooo-site/trunk/content/security/cves/CVE-2013-4156.html (original) +++ websites/staging/ooo-site/trunk/content/security/cves/CVE-2013-4156.html Wed Nov 4 22:39:00 2015 @@ -3,8 +3,8 @@ <head> <link href="/css/ooo.css" rel="stylesheet" type="text/css"> - <title>CVE-2013-4156</title> - <style type="text/css"></style> + <title>CVE-2013-4156</title> + <style type="text/css"></style> <!--#include virtual="/google-analytics.js" --> <!--#include virtual="/scripts/entourage.js" --> @@ -22,36 +22,36 @@ - <h2><a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=2013-4156">CVE-2013-4156</a></h2> + <h2><a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=2013-4156">CVE-2013-4156</a></h2> - <h3>OpenOffice DOCM Memory Corruption Vulnerability</h3> + <h3>OpenOffice DOCM Memory Corruption Vulnerability</h3> - <ul> - <h4>Severity: Important</h4> - <h4>Vendor: The Apache Software Foundation</h4> - <h4>Versions Affected:</h4> - <ul> - <li>Apache OpenOffice 3.4.0 to 3.4.1, on all platforms.</li> - <li>Earlier versions may be also affected.</li> - </ul> - - <h4>Description:</h4> - <p>The vulnerability is caused by mishandling of unknown XML elements when parsing OOXML document files. - Specially crafted documents can be used for denial-of-service attacks. - Further exploits are possible but have not been verified. - - <h4>Mitigation</h4> - <p>Apache OpenOffice 3.4 users are advised to <a href="http://download.openoffice.org">upgrade to Apache OpenOffice 4.0</a>. - Users who are unable to upgrade immediately should be cautious when opening untrusted documents. - - <h4>Credits</h4> - <p>The Apache OpenOffice security team credits Jeremy Brown of Microsoft Vulnerability Research as the discoverer of this flaw.</p> - - <hr /> - - <p><a href="http://security.openoffice.org">Security Home</a> - -> <a href="http://security.openoffice.org/bulletin.html">Bulletin</a> - -> <a href="http://security.openoffice.org/security/cves/CVE-2013-4156.html">CVE-2013-4156</a></p> + <ul> + <h4>Severity: Important</h4> + <h4>Vendor: The Apache Software Foundation</h4> + <h4>Versions Affected:</h4> + <ul> + <li>Apache OpenOffice 3.4.0 to 3.4.1, on all platforms.</li> + <li>Earlier versions may be also affected.</li> + </ul> + + <h4>Description:</h4> + <p>The vulnerability is caused by mishandling of unknown XML elements when parsing OOXML document files. + Specially crafted documents can be used for denial-of-service attacks. + Further exploits are possible but have not been verified. + + <h4>Mitigation</h4> + <p>Apache OpenOffice 3.4 users are advised to <a href="http://download.openoffice.org">upgrade to Apache OpenOffice 4.0</a>. + Users who are unable to upgrade immediately should be cautious when opening untrusted documents. + + <h4>Credits</h4> + <p>The Apache OpenOffice security team credits Jeremy Brown of Microsoft Vulnerability Research as the discoverer of this flaw.</p> + + <hr /> + + <p><a href="http://security.openoffice.org">Security Home</a> + -> <a href="http://security.openoffice.org/security/bulletin.html">Bulletin</a> + -> <a href="http://security.openoffice.org/security/cves/CVE-2013-4156.html">CVE-2013-4156</a></p> </div> <!--#include virtual="/footer.html" --> Modified: websites/staging/ooo-site/trunk/content/security/cves/CVE-2014-3524.html ============================================================================== --- websites/staging/ooo-site/trunk/content/security/cves/CVE-2014-3524.html (original) +++ websites/staging/ooo-site/trunk/content/security/cves/CVE-2014-3524.html Wed Nov 4 22:39:00 2015 @@ -3,8 +3,8 @@ <head> <link href="/css/ooo.css" rel="stylesheet" type="text/css"> - <title>CVE-2014-3524</title> - <style type="text/css"></style> + <title>CVE-2014-3524</title> + <style type="text/css"></style> <!--#include virtual="/google-analytics.js" --> <!--#include virtual="/scripts/entourage.js" --> @@ -22,36 +22,36 @@ - <h2><a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=2014-3524">CVE-2014-3524</a></h2> + <h2><a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=2014-3524">CVE-2014-3524</a></h2> - <h3>OpenOffice Calc Command Injection Vulnerability</h3> + <h3>OpenOffice Calc Command Injection Vulnerability</h3> - <ul> - <h4>Severity: Important</h4> - <h4>Vendor: The Apache Software Foundation</h4> - <h4>Versions Affected:</h4> - <ul> - <li>Apache OpenOffice 4.1.0 and older on Windows.</li> - <li>OpenOffice.org versions are also affected.</li> - </ul> - - <h4>Description:</h4> - <p>The vulnerability allows command injection when loading Calc spreadsheets. - Specially crafted documents can be used for command-injection attacks. - Further exploits are possible but have not been verified. - - <h4>Mitigation</h4> - <p>Apache OpenOffice users are advised to <a href="http://download.openoffice.org">upgrade to Apache OpenOffice 4.1.1</a>. - Users who are unable to upgrade immediately should be cautious when opening untrusted documents. - - <h4>Credits</h4> - <p>The Apache OpenOffice security team credits Rohan Durve and James Kettle of Context Information Security as the discoverer of this flaw.</p> - - <hr /> - - <p><a href="http://security.openoffice.org">Security Home</a> - -> <a href="http://security.openoffice.org/bulletin.html">Bulletin</a> - -> <a href="http://security.openoffice.org/security/cves/CVE-2014-3524.html">CVE-2014-3524</a></p> + <ul> + <h4>Severity: Important</h4> + <h4>Vendor: The Apache Software Foundation</h4> + <h4>Versions Affected:</h4> + <ul> + <li>Apache OpenOffice 4.1.0 and older on Windows.</li> + <li>OpenOffice.org versions are also affected.</li> + </ul> + + <h4>Description:</h4> + <p>The vulnerability allows command injection when loading Calc spreadsheets. + Specially crafted documents can be used for command-injection attacks. + Further exploits are possible but have not been verified. + + <h4>Mitigation</h4> + <p>Apache OpenOffice users are advised to <a href="http://download.openoffice.org">upgrade to Apache OpenOffice 4.1.1</a>. + Users who are unable to upgrade immediately should be cautious when opening untrusted documents. + + <h4>Credits</h4> + <p>The Apache OpenOffice security team credits Rohan Durve and James Kettle of Context Information Security as the discoverer of this flaw.</p> + + <hr /> + + <p><a href="http://security.openoffice.org">Security Home</a> + -> <a href="http://security.openoffice.org/security/bulletin.html">Bulletin</a> + -> <a href="http://security.openoffice.org/security/cves/CVE-2014-3524.html">CVE-2014-3524</a></p> </div> <!--#include virtual="/footer.html" --> Modified: websites/staging/ooo-site/trunk/content/security/cves/CVE-2014-3575.html ============================================================================== --- websites/staging/ooo-site/trunk/content/security/cves/CVE-2014-3575.html (original) +++ websites/staging/ooo-site/trunk/content/security/cves/CVE-2014-3575.html Wed Nov 4 22:39:00 2015 @@ -3,8 +3,8 @@ <head> <link href="/css/ooo.css" rel="stylesheet" type="text/css"> - <title>CVE-2014-3575</title> - <style type="text/css"></style> + <title>CVE-2014-3575</title> + <style type="text/css"></style> <!--#include virtual="/google-analytics.js" --> <!--#include virtual="/scripts/entourage.js" --> @@ -22,36 +22,36 @@ - <h2><a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=2014-3575">CVE-2014-3575</a></h2> + <h2><a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=2014-3575">CVE-2014-3575</a></h2> - <h3>OpenOffice Targeted Data Exposure Using Crafted OLE Objects</h3> + <h3>OpenOffice Targeted Data Exposure Using Crafted OLE Objects</h3> - <ul> - <h4>Severity: Important</h4> - <h4>Vendor: The Apache Software Foundation</h4> - <h4>Versions Affected:</h4> - <ul> - <li>Apache OpenOffice 4.1.0 and older on Windows.</li> - <li>OpenOffice.org versions are also affected.</li> - </ul> - - <h4>Description:</h4> - <p>The exposure exploits the way OLE previews are generated to embed arbitrary - file data into a specially crafted document when it is opened. Data exposure is - possible if the updated document is distributed to other parties. - - <h4>Mitigation</h4> - <p>Apache OpenOffice users are advised to <a href="http://download.openoffice.org">upgrade to Apache OpenOffice 4.1.1</a>. - Users who are unable to upgrade immediately should be cautious when they are asked to "Update Links" for untrusted documents. - - <h4>Credits</h4> - <p>The Apache OpenOffice security team credits Open-Xchange for reporting this flaw.</p> - - <hr /> - - <p><a href="http://security.openoffice.org">Security Home</a> - -> <a href="http://security.openoffice.org/bulletin.html">Bulletin</a> - -> <a href="http://security.openoffice.org/security/cves/CVE-2014-3575.html">CVE-2014-3575</a></p> + <ul> + <h4>Severity: Important</h4> + <h4>Vendor: The Apache Software Foundation</h4> + <h4>Versions Affected:</h4> + <ul> + <li>Apache OpenOffice 4.1.0 and older on Windows.</li> + <li>OpenOffice.org versions are also affected.</li> + </ul> + + <h4>Description:</h4> + <p>The exposure exploits the way OLE previews are generated to embed arbitrary + file data into a specially crafted document when it is opened. Data exposure is + possible if the updated document is distributed to other parties. + + <h4>Mitigation</h4> + <p>Apache OpenOffice users are advised to <a href="http://download.openoffice.org">upgrade to Apache OpenOffice 4.1.1</a>. + Users who are unable to upgrade immediately should be cautious when they are asked to "Update Links" for untrusted documents. + + <h4>Credits</h4> + <p>The Apache OpenOffice security team credits Open-Xchange for reporting this flaw.</p> + + <hr /> + + <p><a href="http://security.openoffice.org">Security Home</a> + -> <a href="http://security.openoffice.org/security/bulletin.html">Bulletin</a> + -> <a href="http://security.openoffice.org/security/cves/CVE-2014-3575.html">CVE-2014-3575</a></p> </div> <!--#include virtual="/footer.html" --> Modified: websites/staging/ooo-site/trunk/content/security/cves/CVE-2015-1774.html ============================================================================== --- websites/staging/ooo-site/trunk/content/security/cves/CVE-2015-1774.html (original) +++ websites/staging/ooo-site/trunk/content/security/cves/CVE-2015-1774.html Wed Nov 4 22:39:00 2015 @@ -111,7 +111,7 @@ <p> <a href="http://security.openoffice.org">Security Home</a> - -> <a href="http://security.openoffice.org/bulletin.html">Bulletin</a> + -> <a href="http://security.openoffice.org/security/bulletin.html">Bulletin</a> -> <a href="http://www.openoffice.org/security/cves/CVE-2015-1774.html">CVE-2015-1774</a> </p> Modified: websites/staging/ooo-site/trunk/content/security/cves/CVE-2015-4551.html ============================================================================== --- websites/staging/ooo-site/trunk/content/security/cves/CVE-2015-4551.html (original) +++ websites/staging/ooo-site/trunk/content/security/cves/CVE-2015-4551.html Wed Nov 4 22:39:00 2015 @@ -132,7 +132,7 @@ <p> <a href="http://security.openoffice.org">Security Home</a> - -> <a href="http://security.openoffice.org/bulletin.html">Bulletin</a> + -> <a href="http://security.openoffice.org/security/bulletin.html">Bulletin</a> -> <a href="http://www.openoffice.org/security/cves/CVE-2015-4551.html">CVE-2015-4551</a> </p> Modified: websites/staging/ooo-site/trunk/content/security/cves/CVE-2015-5212.html ============================================================================== --- websites/staging/ooo-site/trunk/content/security/cves/CVE-2015-5212.html (original) +++ websites/staging/ooo-site/trunk/content/security/cves/CVE-2015-5212.html Wed Nov 4 22:39:00 2015 @@ -117,7 +117,7 @@ <p> <a href="http://security.openoffice.org">Security Home</a> - -> <a href="http://security.openoffice.org/bulletin.html">Bulletin</a> + -> <a href="http://security.openoffice.org/security/bulletin.html">Bulletin</a> -> <a href="http://www.openoffice.org/security/cves/CVE-2015-5212.html">CVE-2015-5212</a> </p> Modified: websites/staging/ooo-site/trunk/content/security/cves/CVE-2015-5213.html ============================================================================== --- websites/staging/ooo-site/trunk/content/security/cves/CVE-2015-5213.html (original) +++ websites/staging/ooo-site/trunk/content/security/cves/CVE-2015-5213.html Wed Nov 4 22:39:00 2015 @@ -112,7 +112,7 @@ <p> <a href="http://security.openoffice.org">Security Home</a> - -> <a href="http://security.openoffice.org/bulletin.html">Bulletin</a> + -> <a href="http://security.openoffice.org/security/bulletin.html">Bulletin</a> -> <a href="http://www.openoffice.org/security/cves/CVE-2015-5213.html">CVE-2015-5213</a> </p> Modified: websites/staging/ooo-site/trunk/content/security/cves/CVE-2015-5214.html ============================================================================== --- websites/staging/ooo-site/trunk/content/security/cves/CVE-2015-5214.html (original) +++ websites/staging/ooo-site/trunk/content/security/cves/CVE-2015-5214.html Wed Nov 4 22:39:00 2015 @@ -112,7 +112,7 @@ <p> <a href="http://security.openoffice.org">Security Home</a> - -> <a href="http://security.openoffice.org/bulletin.html">Bulletin</a> + -> <a href="http://security.openoffice.org/security/bulletin.html">Bulletin</a> -> <a href="http://www.openoffice.org/security/cves/CVE-2015-5214.html">CVE-2015-5214</a> </p>