How to safely update open office to 2.0+?

[KevinO]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Josef Lowder wrote:
> .
> My Mandriva 10 system has Open Office 1.1.5 and I think I would like to update
> it to 2.0 (because I've had a few problems with 1.1.5), but I'm a bit
> apprehensive because the only times I've ever tried to update anything on my
> system that has resulted in problems. 
> 
> Searching the net, I found the following two items, one of which seems
> helpful, but the other increases my paranoia. 
> 
> At this link: http://www.linuxquestions.org/questions/showthread.php?t=387848
> I found some seemingly conflicting counsel, followed by this: 
> 
> 1. Remove the previous version of the Open Office.
>    To do so open the Mandrakelinux Control Center. Then choose
>    the "Software Management" and from there choose "Remove".
>    Search for "open office" and you will see
>    "OpenOffice.org-1.1.3-0.20040820.9mdk".
>    Select this package and click "Remove". The Control Center will
>    prompt you that there are some related packages and they should
>    be choosen too. So click "Ok". It will automatically select all
>    the related packages and press "Remove". Open Office 1.1.3 is gone.
> 2. You probably downloaded a <openoffice version>.tar.gz file
>    from www.openoffice.org. Right click on that file
>    and choose "Actions > Extract Here".
> 3. Open a terminal and sign in as a root.
> 4. Go the the folder where the <openoffice version>.tar.gz is extracted to.
>    (That folder is in the same place with that .tar.gz file and has
>    a similar name to "OOO680_m3_native_packed-2_en-US.8968").
> 5. Type "cd RPMS/" (take you to the RPM folder).
> 6. Type "rpm -vi *.rpm" (install all the rpms).
> 7. Type "cd desktop-integration/ "
> 8. Type "rpm -iv openoffice.org-mandriva-menus-2.0.0-3.noarch.rpm"
>    (I see that you are using Mandrake 10.1)
> 9. Type "openoffice.org-2.0"
>    (This will take you through a registration process)
> 10. Reboot to get rid of the old menu items.
> 
> Does this look like a correct procedure? 
> Is there some way to save my 1.1.5 installation in case the 
> newer version has problems and I want to get back to square one? 
> 
> Then at this link: www.linuxsecurity.com/ I found the following: 
> Mandrake iDefense reported several overflow bugs in libwpd. An attacker could
> create a carefully crafted Word Perfect file that could cause an application
> linked with libwpd, such as OpenOffice, to crash or possibly execute arbitrary
> code if the file was opened by a victim. OpenOffice.org-2.X contains an
> embedded copy of libpwd, and as such is susceptible to the same issues.
> Updated packages have been rebuilt using the system libwpd to address this issue.
> 
> What does all that mean?  Where do I find a new version of Open Office that
> will be safe?  Or should I stay with 1.1.5? 
> 
I have a Mdk 10.0 system here running OpenOffice 2.x.

Here is all that was required (in a nutshell)

# urpme openoffice   (as root, remove all packages)

Grab the latest open office from openoffice.org and install it according to the
directions. (You can stick the new OO directory in /usr/local or /opt)

Place symbolic links in /usr/local/bin pointing to the executables in the new OO
directory.

ex: # cd /usr/local/bin
    # ln -s /usr/local/openoffice/.../soffice .
    # ln -s /usr/local/openoffice/.../swriter .
    # ln -s /usr/local/openoffice/.../scalc .
       .
       .
       .
(You'll have to look to get the right path, these are approximate and variable
since you can put it where you wish.)

Note that the programs will probably have new names, (soffice, scalc, instead of
ooffice, oocalc, etc.)

You will have to create your own icons on the taskbar, and make your own menu
entries if you want those. (I never bother with the menus. It takes longer to
find something in the menus than just typing "swrit<TAB>" in a terminal window
anyway.)

To reverse the process, just delete the new openoffice directory that you made,
and the symbolic links. Then use "urpmi openoffice" to reinstall the old version.

The whole process is pretty straightforward. Any set of instructions telling you
to use the graphical package manager instead of urpmi from the command line is
tailored for newbies.

The command line tools urpmi, urpme, urpmf, urpmq are very good, and not too hard
to figure out. I haven't trusted, nor had the patience to fool around with,
Mandrake's/Mandriva's GUI tools for many years. The GUI tools get improved/borken
in new ways with each release, while the good old command line tools stay pretty
much the same -reducing time spent fiddling and learning the same tools over and
over.  There is actually good documentation for them nowadays too.

Use an 'EasyUrpmi website to make the commands for you to add a full set of
repositories, regardless of what version of Mdk that you end up running.

If you need more help, or have additional questions, feel free to catch me off-list.

BTW - Mandriva 2007 (Free) is pretty good. I just added it as a dual-boot to one
of my boxes Saturday. We have 2006 on the girlfriend's box, and that works too.
- --
KevinO
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFGCMfMI3MJ/OwKti0RAip+AJ9HM9XdtednXH2c90H4pFLcwe/YMQCffJA7
fs60T/MGJPSNC0LWy625Los=
=x64x
-----END PGP SIGNATURE-----