Headline
Debian Security Advisory 5415-1
Debian Linux Security Advisory 5415-1 - Two security issues were discovered in LibreOffice, which could potentially result in the execution of arbitrary code when loading a malformed spreadsheet document or unacknowledged loading of linked documents within a floating frame.
-----BEGIN PGP SIGNED MESSAGE-----Hash: SHA512- -------------------------------------------------------------------------Debian Security Advisory DSA-5415-1 [email protected]://www.debian.org/security/ Moritz MuehlenhoffMay 28, 2023 https://www.debian.org/security/faq- -------------------------------------------------------------------------Package : libreofficeCVE ID : CVE-2023-0950 CVE-2023-2255Two security issues were discocvered in LibreOffice, which couldpotentially result in the execution of arbitrary code when loading amalformed spreadsheet document or unacknowlegded loading of linkeddocuments within a floating frame.For the stable distribution (bullseye), these problems have been fixed inversion 1:7.0.4-4+deb11u7.We recommend that you upgrade your libreoffice packages.For the detailed security status of libreoffice please refer toits security tracker page at:https://security-tracker.debian.org/tracker/libreofficeFurther information about Debian Security Advisories, how to applythese updates to your system and frequently asked questions can befound at: https://www.debian.org/security/Mailing list: [email protected] PGP SIGNATURE-----iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmRzchEACgkQEMKTtsN8TjbRrRAAh/7Ahy9I1prBZqnkRKL3JubDmB7+ni9lK1Jmw0wRGVEBFiFOL6wmJXNiHeqXwx/mNv0/PBZGBNsicKAtftv9ixWfWumBKZSWEfPF9wVDwYGBF6xgC8adCcHk4PZ+/DhuNmGoeTJt6FokhkD/AiATR4IhJJLVUwexZV4jMTRyK85JJ4fTkjZnWgk+OkhHMEBMnAIqjWvpS5HapkTuqBvkzNS9+CgZgi03hcSCCdOP4ioGCQt6pHMrpZ0PyOyJukKOR3FO7YMV1U93dcH7wBrMMRilhH6CAXlAVhQz+48A9sXpZN44zYDdEWv6PNrMNhscLXH2bP1JFB2QGh43dMwt+C5VLlWU1BEWHndVE4Juiq5gkBbfCiENXbjSjxt61f1ZxqlMWBGirgePk9p1y0oZj3E0PKgxo8ViCU5ReaRw2LglGzLR+6bgeav52Zk5nJfKQThGKRWbhncXkF0exVtaaJIVw7NGjzPPZqGsIin/XySxBVIljzP1bPi/cW3oW2t81e5uL6ffWM37sM1K0H2E5CQRNvAr0S2L+5AeJa3f1qmzN00pwnmGdLnV/xA0hftn4NWRtdoFbnPTclpyOVH5M3P4D58NY9Hbc+VAQhViWAdt05HnKtKlxU/zq3Sn+qo9IVAtjaD+DiRuhZfXKNaLbP8apQoISsjZnemH0X+HQVM57e-----END PGP SIGNATURE-----Related news
Gentoo Linux Security Advisory 202311-15 - Multiple vulnerabilities have been discovered in LibreOffice, the worst of which could lead to code execution. Versions greater than or equal to 7.5.3.2 are affected.
Ubuntu Security Notice 6144-1 - It was discovered that LibreOffice did not properly validate the number of parameters passed to the formula interpreter, leading to an array index underflow attack. If a user were tricked into opening a specially crafted spreadsheet file, an attacker could possibly use this issue to execute arbitrary code. Amel Bouziane-Leblond discovered that LibreOffice did not prompt the user before loading the host document inside an IFrame. If a user were tricked into opening a specially crafted input file, an attacker could possibly use this issue to cause information disclosure or execute arbitrary code.
Improper Validation of Array Index vulnerability in the spreadsheet component of The Document Foundation LibreOffice allows an attacker to craft a spreadsheet document that will cause an array index underflow when loaded. In the affected versions of LibreOffice certain malformed spreadsheet formulas, such as AGGREGATE, could be created with less parameters passed to the formula interpreter than it expected, leading to an array index underflow, in which case there is a risk that arbitrary code could be executed. This issue affects: The Document Foundation LibreOffice 7.4 versions prior to 7.4.6; 7.5 versions prior to 7.5.1.
Improper access control in editor components of The Document Foundation LibreOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt. In the affected versions of LibreOffice documents that used "floating frames" linked to external files, would load the contents of those frames without prompting the user for permission to do so. This was inconsistent with the treatment of other linked content in LibreOffice. This issue affects: The Document Foundation LibreOffice 7.4 versions prior to 7.4.7; 7.5 versions prior to 7.5.3.