UbuntuUpdates.org

Package "libreoffice"

Name: libreoffice

Description:

office productivity suite (metapackage)
Latest version: 1:5.1.6~rc2-0ubuntu1~xenial10
Release: xenial (16.04)
Level: updates
Repository: universe
Homepage: http://www.libreoffice.org

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "libreoffice"

32-bit deb package
64-bit deb package
APT INSTALL

Other versions of "libreoffice" in Xenial

Repository Area Version
base main 5.1.2-0ubuntu1
base universe 1:5.1.2-0ubuntu1
security universe 1:5.1.6~rc2-0ubuntu1~xenial10
security main 5.1.6~rc2-0ubuntu1~xenial10
updates main 5.1.6~rc2-0ubuntu1~xenial10
PPA: LibreOffice 1:6.2.8~rc2-0ubuntu0.16.04.1

Packages in group

Deleted packages are displayed in grey.


Changelog

Version: 1:5.1.6~rc2-0ubuntu1~xenial10 2019-09-24 15:06:31 UTC

  libreoffice (1:5.1.6~rc2-0ubuntu1~xenial10) xenial-security; urgency=medium

  * SECURITY UPDATE: Unsafe URL assembly flaw in allowed script location check
    - debian/patches/CVE-2019-9854.diff: assemble the parsed url describing a
      script's location from the output of the preceding verification step.
    - CVE-2019-9854

 -- Marcus Tomlinson <email address hidden> Sat, 21 Sep 2019 13:44:15 +0200
Source diff to previous version
CVE-2019-9854 LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document

Version: 1:5.1.6~rc2-0ubuntu1~xenial9 2019-08-19 13:08:53 UTC

  libreoffice (1:5.1.6~rc2-0ubuntu1~xenial9) xenial-security; urgency=medium

  * SECURITY UPDATE: Insufficient URL validation allowing LibreLogo script execution
    - debian/patches/CVE-2019-9850_1_2.diff: decode escape codes and ban scripts
      with "LibreLogo" anywhere in its path.
    - CVE-2019-9850
  * SECURITY UPDATE: LibreLogo global-event script execution
    - debian/patches/CVE-2019-9850_1_2.diff: catch more LibreLogo script executions
      by expanding check to global events.
    - CVE-2019-9851
  * SECURITY UPDATE: Insufficient URL encoding flaw in allowed script location check
    - debian/patches/CVE-2019-9850_1_2.diff: ensure that all URLs leaving
      scriptURI2StorageUri() are percent-encoded.
    - CVE-2019-9852

 -- Marcus Tomlinson <email address hidden> Wed, 14 Aug 2019 15:16:33 +0100
Source diff to previous version
CVE-2019-9850 LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained
CVE-2019-9851 LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained
CVE-2019-9852 LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document

Version: 1:5.1.6~rc2-0ubuntu1~xenial8 2019-07-17 20:07:20 UTC

  libreoffice (1:5.1.6~rc2-0ubuntu1~xenial8) xenial-security; urgency=medium

  * SECURITY UPDATE: LibreLogo arbitrary script execution
    - debian/patches/CVE-2019-9848.diff: don't allow LibreLogo to be used with
      mouseover/etc dom-alike events.
    - CVE-2019-9848
  * SECURITY UPDATE: Remote bullet graphics retrieved in 'stealth mode'
    - debian/patches/CVE-2019-9849.diff: include bullet graphics in 'stealth
      mode' protection.
    - CVE-2019-9849

 -- Marcus Tomlinson <email address hidden> Tue, 16 Jul 2019 17:28:21 +0100
Source diff to previous version
CVE-2019-9848 LibreLogo arbitrary script execution
CVE-2019-9849 remote bullet graphics retrieved in 'stealth mode'

Version: 1:5.1.6~rc2-0ubuntu1~xenial7 2019-05-30 11:07:10 UTC

  libreoffice (1:5.1.6~rc2-0ubuntu1~xenial7) xenial; urgency=medium

  [ Ikuya Awashiro ]
  * debian/patches/new-japanese-era-name.patch (LP: #1827451):
    Add new Japanse era name "Reiwa" support which taken from upstream:
    https://cgit.freedesktop.org/libreoffice/core/commit/?id=cacbb0faef77ae8462de9ff5c7307a6a2e28b2bb
    https://cgit.freedesktop.org/libreoffice/core/commit/?id=597c5d75b8e72d429e096535334eaac7973455ef

   [ Olivier Tilloy ]
   * debian/patches/java.vendor-Ubuntu.patch: update to also recognize
     "Private Build" as java.vendor (for custom PPA builds) (LP: #1822839)
   * debian/patches/java.vendor-Ubuntu.patch: also make jvmfwk recognize
     "Ubuntu" as java.vendor (LP: #1822839)

   [ Rene Engelhard ]
   * debian/patches/java.vendor-Debian.diff: make jvmfwk recognize "Debian"
     as java.vendor as that's what is set in openjdk 11 >= 11.0.3+4-2
     - see #926009 (closes: #926318) (LP: #1822839)

 -- Marcus Tomlinson <email address hidden> Fri, 03 May 2019 15:40:44 +0100
Source diff to previous version
1827451 Japanese new era \
926318 LibreOffice does not recognize new "Debian" JDK (openjdk 11 >= 11.0.3+4-2) - Debian Bug report logs

Version: 1:5.1.6~rc2-0ubuntu1~xenial6 2019-02-06 17:06:46 UTC

  libreoffice (1:5.1.6~rc2-0ubuntu1~xenial6) xenial-security; urgency=medium

  * SECURITY UPDATE: incorrect integer data type in StgSmallStrm class
    - debian/patches/CVE-2018-10119.patch: use short->sal_Int32 like in
      StgDataStrm in sot/source/sdstor/stgstrms.cxx.
    - CVE-2018-10119
  * SECURITY UPDATE: heap-based buffer overflow in SwCTBWrapper::Read
    - debian/patches/CVE-2018-10120.patch: check index before use in
      sw/source/filter/ww8/ww8toolbar.cxx.
    - CVE-2018-10120
  * SECURITY UPDATE: information disclosure vulnerability via SMB link
    - debian/patches/CVE-2018-10583.patch: set Referer on link
      mediadescriptor in sw/source/filter/xml/xmltexti.cxx.
    - CVE-2018-10583
  * SECURITY UPDATE: Directory traversal flaw in script execution
    - debian/patches/CVE-2018-16858.patch: keep pyuno script processing
      below base uri in scripting/source/pyprov/pythonscript.py.
    - CVE-2018-16858

 -- Marc Deslauriers <email address hidden> Mon, 28 Jan 2019 11:59:02 -0500
CVE-2018-10119 sot/source/sdstor/stgstrms.cxx in LibreOffice before 5.4.5.1 and 6.x before 6.0.1.1 uses an incorrect integer data type in the StgSmallStrm class, wh
CVE-2018-10120 The SwCTBWrapper::Read function in sw/source/filter/ww8/ww8toolbar.cxx in LibreOffice before 5.4.6.1 and 6.x before 6.0.2.1 does not validate a custo
CVE-2018-10583 An information disclosure vulnerability occurs when LibreOffice 6.0.3 and Apache OpenOffice Writer 4.1.5 automatically process and initiate an SMB co
CVE-2018-16858 Remote Code Execution via Macro/Event execution


About   -   Send Feedback to @ubuntu_updates