UbuntuUpdates.org

Package "libreoffice"

Name: libreoffice

Description:

office productivity suite (metapackage)
Latest version: 1:7.3.7-0ubuntu0.22.04.7
Release: jammy (22.04)
Level: security
Repository: universe
Homepage: http://www.libreoffice.org

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "libreoffice"

32-bit deb package
64-bit deb package
APT INSTALL

Other versions of "libreoffice" in Jammy

Repository Area Version
base universe 1:7.3.2-0ubuntu2
base main 1:7.3.2-0ubuntu2
security main 1:7.3.7-0ubuntu0.22.04.7
updates main 1:7.3.7-0ubuntu0.22.04.7
updates universe 1:7.3.7-0ubuntu0.22.04.7
backports main 4:24.2.7-0ubuntu0.24.04.1~bpo22.04.1
backports universe 4:24.2.7-0ubuntu0.24.04.1~bpo22.04.1
PPA: LibreOffice 4:24.8.3~rc2-0ubuntu0.22.04.1~lo1

Packages in group

Deleted packages are displayed in grey.


Changelog

Version: 1:7.3.7-0ubuntu0.22.04.7 2024-09-19 16:07:11 UTC

  libreoffice (1:7.3.7-0ubuntu0.22.04.7) jammy-security; urgency=medium

  * SECURITY UPDATE: Signatures in "repair mode" should not be trusted
    - debian/patches/CVE-2024-7788.patch: sfx2: SfxObjectShell should
      not trust any signature on repaired package
    - CVE-2024-7788

 -- Rico Tzschichholz <email address hidden> Wed, 18 Sep 2024 17:10:51 +0200
Source diff to previous version
CVE-2024-7788 Improper Digital Signature Invalidation  vulnerability in Zip Repair Mode of The Document Foundation LibreOffice allows Signature forgery vulnerabili

Version: 1:7.3.7-0ubuntu0.22.04.6 2024-08-15 16:07:14 UTC

  libreoffice (1:7.3.7-0ubuntu0.22.04.6) jammy-security; urgency=medium

  * SECURITY UPDATE: Ability to trust not validated macro signatures
    removed in high security mode (LP: #2076130)
    - debian/patches/CVE-2024-6472.patch: remove ability to trust not
      validated macro signatures in high security
    - CVE-2024-6472

 -- Rico Tzschichholz <email address hidden> Mon, 05 Aug 2024 21:22:27 +0200
Source diff to previous version
2076130 CVE-2024-6472
CVE-2024-6472 Certificate Validation user interface in LibreOffice allows potential vulnerability. Signed macros are scripts that have been digitally signed by

Version: 1:7.3.7-0ubuntu0.22.04.5 2024-05-28 13:07:12 UTC

  libreoffice (1:7.3.7-0ubuntu0.22.04.5) jammy-security; urgency=medium

  * SECURITY UPDATE: Graphic on-click binding allows unchecked script
     execution
    - debian/patches/CVE-2024-3044.patch: add notify for script use
    - CVE-2024-3044

 -- Rico Tzschichholz <email address hidden> Wed, 15 May 2024 09:06:02 +0200
Source diff to previous version
CVE-2024-3044 Unchecked script execution in Graphic on-click binding in affected LibreOffice versions allows an attacker to create a document which without prompt

Version: 1:7.3.7-0ubuntu0.22.04.4 2023-12-14 15:06:56 UTC

  libreoffice (1:7.3.7-0ubuntu0.22.04.4) jammy-security; urgency=medium

  * SECURITY UPDATE: Improper input validation enabling arbitrary Gstreamer
     pipeline injection
    - debian/patches/CVE-2023-6185.patch: escape url passed to gstreamer
    - CVE-2023-6185
  * SECURITY UPDATE: Link targets allow arbitrary script execution
    - debian/patches/CVE-2023-6186-*.patch: multiple commits to fix
      security issues.
    - CVE-2023-6186
  * patches/CppunitTest_desktop_lib-adjust-asserts-so-this-works.patch:
    - Usage of expired certificates in CppunitTest_desktop_lib:
      adjust asserts so this works again

 -- Rico Tzschichholz <email address hidden> Mon, 11 Dec 2023 15:19:13 +0100
Source diff to previous version
CVE-2023-6185 Improper input validation enabling arbitrary Gstreamer pipeline injection
CVE-2023-6186 Link targets allow arbitrary script execution

Version: 1:7.3.7-0ubuntu0.22.04.3 2023-06-07 07:14:24 UTC

  libreoffice (1:7.3.7-0ubuntu0.22.04.3) jammy-security; urgency=high

  * SECURITY UPDATE: Remote documents loaded without prompt via IFrame
    - debian/patches/CVE-2023-2255-*.patch: multiple commits to fix
      security issues.
    - CVE-2023-2255
  * SECURITY UPDATE: Array Index UnderFlow in Calc Formula Parsing
    - debian/patches/CVE-2023-0950.patch: Obtain actual 0-parameter count
      for OR(), AND() and 1-parameter functions
    - CVE-2023-0950

 -- Rico Tzschichholz <email address hidden> Thu, 25 May 2023 22:52:23 +0200
CVE-2023-2255 Improper access control in editor components of The Document Foundation LibreOffice allowed an attacker to craft a document that would cause external
CVE-2023-0950 Improper Validation of Array Index vulnerability in the spreadsheet component of The Document Foundation LibreOffice allows an attacker to craft a sp


About   -   Send Feedback to @ubuntu_updates