Bug 50150

Summary:	libreoffice: Multiple issues (4.3)
Product:	UCS	Reporter:	Quality Assurance <qa>
Component:	Security updates	Assignee:	Quality Assurance <qa>
Status:	CLOSED FIXED	QA Contact:	Philipp Hahn <hahn>
Severity:	normal
Priority:	P3
Version:	UCS 4.3
Target Milestone:	UCS 4.3-4-errata
Hardware:	All
OS:	Linux
What kind of report is it?:	Security Issue	What type of bug is this?:	---
Who will be affected by this bug?:	---	How will those affected feel about the bug?:	---
User Pain:		Enterprise Customer affected?:
School Customer affected?:		ISV affected?:
Waiting Support:		Flags outvoted (downgraded) after PO Review:
Ticket number:		Bug group (optional):
Max CVSS v3 score:	9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) NVD

Description Quality Assurance

2019-09-09 15:40:53 CEST

New Debian libreoffice 1:5.2.7-1+deb9u11 fixes:
This update addresses the following issues:
* LibreOffice has a feature where documents can specify that pre-installed  macros can be executed on various script events such as mouse-over,  document-open etc. Access is intended to be restricted to scripts under the  share/Scripts/python, user/Scripts/python sub-directories of the  LibreOffice install. Protection was added, to address CVE-2019-9852, to  avoid a directory traversal attack where scripts in arbitrary locations on  the file system could be executed by employing a URL encoding attack to  defeat the path verification step. However this protection could be  bypassed by taking advantage of a flaw in how LibreOffice assembled the  final script URL location directly from components of the passed in path as  opposed to solely from the sanitized output of the path verification step.  This issue affects: Document Foundation LibreOffice 6.2 versions prior to  6.2.7; 6.3 versions prior to 6.3.1. (CVE-2019-9854)

Comment 1 Quality Assurance

2019-09-09 17:01:40 CEST

--- mirror/ftp/4.3/unmaintained/component/4.3-4-errata/source/libreoffice_5.2.7-1+deb9u10.dsc
+++ apt/ucs_4.4-0-errata4.4-1/source/libreoffice_5.2.7-1+deb9u11.dsc
@@ -1,3 +1,13 @@
+1:5.2.7-1+deb9u11 [Fri, 06 Sep 2019 11:53:15 +0200] Rene Engelhard <rene@debian.org>:
+
+  * debian/patches/expand-pyuno-path-separators.diff.
+    debian/patches/construct-final-url-from-parsed-output.diff,
+    debian/patches/an-absolute-uri-is-invalid-input.diff,
+    debian/patches/Improve-check-for-absolute-URI.diff,
+    debian/patches/Improve-check.diff: add from
+    libreoffice-6-3(-0,-1) branch - more fixes...
+    (CVE-2019-9854/CVE-2019-9855)
+
 1:5.2.7-1+deb9u10 [Tue, 06 Aug 2019 20:20:01 +0200] Rene Engelhard <rene@debian.org>:
 
   * debian/patches/expand-LibreLogo-checks-to-global-events.diff,
@@ -6,5 +16,5 @@
     debian/patches/Properly-obtain-location.diff:
     backport from libreoffice-6-3-0 branch - more fixes for CVE-2019-9848 and
     CVE-2018-16858
-    (CVE-2019-9850/CVE-2019-9851)
+    (CVE-2019-9850/CVE-2019-9851/CVE-2019-9852/CVE-2019-9853)
 

<http://10.200.17.11/4.3-4/#2902344531340208062>

Comment 2 Philipp Hahn

2019-09-10 11:35:29 CEST

OK: yaml
OK: announce_errata
OK: patch
OK: piuparts

[4.3-4] 1e84abba3d Bug #50150: libreoffice 1:5.2.7-1+deb9u11
 doc/errata/staging/libreoffice.yaml | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

[4.3-4] f6d3c68336 Bug #50150: libreoffice 1:5.2.7-1+deb9u11
 doc/errata/staging/libreoffice.yaml | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

Comment 3 Erik Damrose

2019-09-11 15:56:10 CEST

<http://errata.software-univention.de/ucs/4.3/579.html>