Описание
Security update for libreoffice
This update for fixes the following issues:
libreoffice was updated rom 7.5.4.1 to 7.6.2.1 (jsc#PED-6799, jsc#PED-6800):
-
For the highlights of changes of version 7.6 please consult the official release notes:
-
You can check for each minor release notes here:
- https://wiki.documentfoundation.org/Releases/7.6.2/RC1
- https://wiki.documentfoundation.org/Releases/7.6.1/RC2
- https://wiki.documentfoundation.org/Releases/7.6.1/RC1
- https://wiki.documentfoundation.org/Releases/7.6.0/RC3
- https://wiki.documentfoundation.org/Releases/7.6.0/RC2
- https://wiki.documentfoundation.org/Releases/7.6.0/RC1
-
Security issues fixed:
- CVE-2023-1183: Fixed arbitrary file write in LibreOffice Base (bsc#1212444, bsc#1209243)
-
Updated bundled dependencies:
- boost version update from 1_80_0 to 1_82_0
- curl version update from 8.0.1 to 8.2.1
- icu4c-data version update from 72_1 to 73_2
- icu4c version update from 72_1 to 73_2
- pdfium version update from 5408 to 5778
- poppler version update from 22.12.0 to 23.06.0
- poppler-data version update from 0.4.11 to 0.4.12
- skia version from m103-b301ff025004c9cd82816c86c547588e6c24b466 to skia-m111-a31e897fb3dcbc96b2b40999751611d029bf5404
-
New bundled dependencies:
- graphite2-minimal-1.3.14.tgz
- harfbuzz-8.0.0.tar.xz
-
New build dependencies:
- frozen-devel
- liborcus-0_18-0
- libixion
- mdds-2_1
-
New runtime dependencies:
libreoffice-draw
requireslibreoffice-impress
(bsc#1215595)
frozen was implemented:
- New Libreoffice package dependency
libixion was updated to version 0.18.1:
-
Updated to 0.18.1:
- Fixed a 32-bit Linux build issue as discovered on Debian, due to a clash on two 32-bit unsigned integer types being used with std::variant.
-
Updated to 0.18.0:
- Removed the formula_model_access interface from model_context, and switched to using model_context directly everywhere.
- Revised formula_tokens_t type to remove use of std::unique_ptr for each formula_token instance. This should improve memory locality when iterating through an array of formula token values. A similar change has also been made to lexer_tokens_t and lexer_token types.
- Added 41 built-in functions
- Added support for multi-sheet references in Excel A1 and Excel R1C1 grammers.
liborcus was updated to version 0.18.1:
-
Updated to 0.18.1:
-
sax parser:
- added support for optionally skipping multiple BOM's in the beginning of XML stream. This affects all XML-based file format filters such as xls-xml (aka Excel 2003 XML).
-
xml-map:
- fixed a bug where an XML document consisting of simple single-column records were not properly converted to sheet data
-
xls-xml:
- fixed a bug where the filter would always pass border color even when it was not set
-
buildsystem:
- added new configure switches --without-benchmark and --without-doc-example to optinally skip building of these two directories
-
mdds-2_1 was implemented:
- New Libreoffice package dependency
Список пакетов
SUSE Linux Enterprise Module for Package Hub 15 SP4
SUSE Linux Enterprise Module for Package Hub 15 SP5
SUSE Linux Enterprise Workstation Extension 15 SP4
SUSE Linux Enterprise Workstation Extension 15 SP5
openSUSE Leap 15.4
openSUSE Leap 15.5
Ссылки
- Link for SUSE-SU-2023:4496-1
- E-Mail link for SUSE-SU-2023:4496-1
- SUSE Security Ratings
- SUSE Bug 1209243
- SUSE Bug 1212444
- SUSE Bug 1215595
- SUSE CVE CVE-2023-1183 page
Описание
A flaw was found in the Libreoffice package. An attacker can craft an odb containing a "database/script" file with a SCRIPT command where the contents of the file could be written to a new file whose location was determined by the attacker.
Затронутые продукты
Ссылки
- CVE-2023-1183
- SUSE Bug 1212444