[Bug 174112] Re: [openoffice.org] [CVE-2007-4575] Potential arbitrary code execution vulnerability in 3rd party module (HSQLDB)

** Changed in: openoffice.org (Gentoo Linux) Importance: Unknown = High ** Changed in: hsqldb (Gentoo Linux) Importance: Unknown = Medium -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/174112

[Bug 174112] Re: [openoffice.org] [CVE-2007-4575] Potential arbitrary code execution vulnerability in 3rd party module (HSQLDB)

There's still no fix for this available as of now. -- [openoffice.org] [CVE-2007-4575] Potential arbitrary code execution vulnerability in 3rd party module (HSQLDB) https://bugs.launchpad.net/bugs/174112 You received this bug notification because you are a member of Ubuntu Bugs, which is

Re: [Bug 174112] Re: [openoffice.org] [CVE-2007-4575] Potential arbitrary code execution vulnerability in 3rd party module (HSQLDB)

On Tue, May 06, 2008 at 09:42:45AM -, hk47 wrote: There's still no fix for this available as of now. It's almost done -- there is a lot of churn after the release. Hopefully it will publish today. -- [openoffice.org] [CVE-2007-4575] Potential arbitrary code execution vulnerability in 3rd

[Bug 174112] Re: [openoffice.org] [CVE-2007-4575] Potential arbitrary code execution vulnerability in 3rd party module (HSQLDB)

This has been addressed by USN: http://www.ubuntu.com/usn/usn-609-1 ** Changed in: openoffice.org (Ubuntu Edgy) Assignee: Chris Cheney (ccheney) = Kees Cook (keescook) Status: In Progress = Won't Fix ** Changed in: openoffice.org (Ubuntu Dapper) Assignee: Chris Cheney (ccheney)

[Bug 174112] Re: [openoffice.org] [CVE-2007-4575] Potential arbitrary code execution vulnerability in 3rd party module (HSQLDB)

I believe that this CVE along with the newer one will be fixed in a security announcement early next week. It appears the security team is being held up by some infrastructure work. -- [openoffice.org] [CVE-2007-4575] Potential arbitrary code execution vulnerability in 3rd party module (HSQLDB)

[Bug 174112] Re: [openoffice.org] [CVE-2007-4575] Potential arbitrary code execution vulnerability in 3rd party module (HSQLDB)

** Changed in: openoffice.org (Ubuntu) Assignee: Chris Cheney (ccheney) = (unassigned) Status: In Progress = Fix Released ** Changed in: openoffice.org (Ubuntu Dapper) Importance: Undecided = Critical Assignee: (unassigned) = Chris Cheney (ccheney) Status: New = In

[Bug 174112] Re: [openoffice.org] [CVE-2007-4575] Potential arbitrary code execution vulnerability in 3rd party module (HSQLDB)

** Changed in: openoffice.org (Gentoo Linux) Status: Unknown = Fix Released ** Changed in: hsqldb (Gentoo Linux) Status: Unknown = Fix Released -- [openoffice.org] [CVE-2007-4575] Potential arbitrary code execution vulnerability in 3rd party module (HSQLDB)

[Bug 174112] Re: [openoffice.org] [CVE-2007-4575] Potential arbitrary code execution vulnerability in 3rd party module (HSQLDB)

** Bug watch added: Gentoo Bugzilla #200771 http://bugs.gentoo.org/show_bug.cgi?id=200771 ** Also affects: openoffice.org (Gentoo Linux) via http://bugs.gentoo.org/show_bug.cgi?id=200771 Importance: Unknown Status: Unknown -- [openoffice.org] [CVE-2007-4575] Potential arbitrary

[Bug 174112] Re: [openoffice.org] [CVE-2007-4575] Potential arbitrary code execution vulnerability in 3rd party module (HSQLDB)

** Bug watch added: Gentoo Bugzilla #201799 http://bugs.gentoo.org/show_bug.cgi?id=201799 ** Also affects: hsqldb (Gentoo Linux) via http://bugs.gentoo.org/show_bug.cgi?id=201799 Importance: Unknown Status: Unknown -- [openoffice.org] [CVE-2007-4575] Potential arbitrary code

[Bug 174112] Re: [openoffice.org] [CVE-2007-4575] Potential arbitrary code execution vulnerability in 3rd party module (HSQLDB)

** Changed in: openoffice.org (Ubuntu) Status: Confirmed = In Progress -- [openoffice.org] [CVE-2007-4575] Potential arbitrary code execution vulnerability in 3rd party module (HSQLDB) https://bugs.launchpad.net/bugs/174112 You received this bug notification because you are a member of

[Bug 174112] Re: [openoffice.org] [CVE-2007-4575] Potential arbitrary code execution vulnerability in 3rd party module (HSQLDB)

The Debian fix is for one particular version of hsqldb and openoffice so no they won't work as is since Debian and Ubuntu release cycles aren't in sync. I should have a patch from upstream within the next couple days. Thanks, Chris Cheney -- [openoffice.org] [CVE-2007-4575] Potential arbitrary

[Bug 174112] Re: [openoffice.org] [CVE-2007-4575] Potential arbitrary code execution vulnerability in 3rd party module (HSQLDB)

Can the Debian fixes not be used? http://www.debian.org/security/2007/dsa-1419 -- [openoffice.org] [CVE-2007-4575] Potential arbitrary code execution vulnerability in 3rd party module (HSQLDB) https://bugs.launchpad.net/bugs/174112 You received this bug notification because you are a member of

[Bug 174112] Re: [openoffice.org] [CVE-2007-4575] Potential arbitrary code execution vulnerability in 3rd party module (HSQLDB)

I'm sorry I didn't respond to this bug earlier. I am working with the hsqldb author on a fix that won't require any changes to the openoffice.org codebase which allows us to not have to push as much data out. Hopefully this will be rolled out by the end of the week. Thanks, Chris Cheney --

[Bug 174112] Re: [openoffice.org] [CVE-2007-4575] Potential arbitrary code execution vulnerability in 3rd party module (HSQLDB)

** Changed in: openoffice.org (Ubuntu) Importance: Undecided = Critical Assignee: (unassigned) = Chris Cheney (ccheney) Status: New = Confirmed -- [openoffice.org] [CVE-2007-4575] Potential arbitrary code execution vulnerability in 3rd party module (HSQLDB)