Bug#770166: Several crashes opening malformed files
On Thu, Nov 20, 2014 at 05:15:36PM +0300, Alexander Cherepanov wrote:
> Not sure what you mean. If you talk about master -- maybe. But for
> 3.5.4 https://bugs.freedesktop.org/show_bug.cgi?id=86449 (and the list
> linked above) clearly says "potentially exploitable". Do you disagree
> with this assessment and need an actual exploit?
One can claim anything "potentially explitable". Besides that, yes, I
would want one. But in any case, if it _is_ exploitable this should be
discussed elsewhere, not here.
> How to deal with it is entirely different question. One can think
> about various possible solutions -- from adding "Known bugs" section
> to the man page stating "Opening a file in LO that you get by email
> can cause you to loose the work you are doing in another LO window or
> your computer to be pwned.
That is the case for any crash. Even a crash for whatever reason with
your own document.
> to disabling some input filters by default (and caring about other filters).
Right. doc and rtf. Would be extremely helpful to do that given the most
important usescase for using LOs filters is to open §/(§ .docs from somewhere.
> Yes, that would be a security issue. What is surprising about it?
> Should it be any different from, e.g., browsers?
Browsers are directly on the net. And yes, if crashes turn out to be
exploitable of course it should be fixed.
> If there are nobody who cares enough about LO to join you supporting
> it in Stable perhaps it should be EOLed similar to Iceweasel?
Even 4.2.x is EOL by now upstream...
But yes, if I have *official* security patches I *do* care whether
they can be backported to 3.5.4. But not "maybe"s. The *only* support
of this ancient version in stable is security, nothing more. Not crashes
or hangs.
Regards,
Rene
Reply to: