Red Hat Security Advisory: libreoffice security update

Fixed packages 217

Vulnerabilities 4

• Unscored —
  CVE-2022-26305

  Execution of Untrusted Macros Due to Improper Certificate Validation

  An Improper Certificate Validation vulnerability in LibreOffice existed where determining if a macro was signed by a trusted author was done by only matching the serial number and issuer string of the used certificate with that of a trusted certificate. This …

  The Document Foundation LibreOffice libreoffice libreoffice Debian Ubuntu Alpine
  Jul 25, 2022
• Unscored —
  CVE-2022-26306

  Execution of Untrusted Macros Due to Improper Certificate Validation

  LibreOffice supports the storage of passwords for web connections in the user’s configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in LibreOffice existed where the required initialization vector fo…

  The Document Foundation LibreOffice libreoffice libreoffice Debian Ubuntu Alpine
  Jul 25, 2022
• Unscored —
  CVE-2022-26307

  Weak Master Keys

  LibreOffice supports the storage of passwords for web connections in the user’s configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in LibreOffice existed where master key was poorly encoded resulti…

  The Document Foundation LibreOffice libreoffice libreoffice Debian Ubuntu Alpine
  Jul 25, 2022
• Unscored —
  CVE-2022-3140

  Macro URL arbitrary script execution

  LibreOffice supports Office URI Schemes to enable browser integration of LibreOffice with MS SharePoint server. An additional scheme 'vnd.libreoffice.command' specific to LibreOffice was added. In the affected versions of LibreOffice links using that scheme c…

  The Document Foundation LibreOffice libreoffice libreoffice Debian Ubuntu Alpine
  Oct 11, 2022

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2118610
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2118611
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2118613
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2134697
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0304.json
• report
  https://access.redhat.com/security/cve/CVE-2022-3140
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-3140
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-3140
• article
  https://www.libreoffice.org/about-us/security/advisories/CVE-2022-3140
• report
  https://access.redhat.com/security/cve/CVE-2022-26305
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-26305
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-26305
• report
  https://access.redhat.com/security/cve/CVE-2022-26306
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-26306
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-26306
• report
  https://access.redhat.com/security/cve/CVE-2022-26307
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-26307
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-26307