Все бюллетени/p10/ALT-PU-2022-1591-1
ALT-PU-2022-1591-1

Обновление пакета LibreOffice в ветке p10

Версия7.3.2.1-alt1
Задание#293651
Опубликовано2022-03-28
Макс. серьёзностьCRITICAL
Серьёзность:

Закрытые проблемы (4)

BDU:2022-02189
MEDIUM6.3

Уязвимость пакета офисных программ LibreOffice, связанная с некорректной проверкой криптографической подписи, позволяющая нарушителю обойти ограничения безопасности

Опубликовано: 2022-04-13Изменено: 2023-11-21
CVSS 3.xСРЕДНЯЯ 6.3
CVSS:3.x/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:H
CVSS 2.0СРЕДНЯЯ 5.7
CVSS:2.0/AV:L/AC:H/Au:S/C:P/I:C/A:C
Ссылки
BDU:2022-04771
CRITICAL9.8

Уязвимость пакета офисных программ LibreOffice, связанная с неправильным подтверждением подлинности сертификата, позволяющая нарушителю выполнить произвольный код

Опубликовано: 2022-08-04Изменено: 2023-12-26
CVSS 3.xКРИТИЧЕСКАЯ 9.8
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0КРИТИЧЕСКАЯ 10.0
CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:C/A:C
Ссылки
CVE-2021-25636
HIGH7.5

LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurred since the last signing and that the signature is valid. An Improper Certificate Validation vulnerability in LibreOffice allowed an attacker to create a digitally signed ODF document, by manipulating the documentsignatures.xml or macrosignatures.xml stream within the document to contain both "X509Data" and "KeyValue" children of the "KeyInfo" tag, which when opened caused LibreOffice to verify using the "KeyValue" but to report verification with the unrelated "X509Data" value. This issue affects: The Document Foundation LibreOffice 7.2 versions prior to 7.2.5.

Опубликовано: 2022-02-24Изменено: 2024-11-21
CVSS 2.0СРЕДНЯЯ 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:P/A:N
CVSS 3.xВЫСОКАЯ 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Ссылки
CVE-2022-26305
HIGH7.5

An Improper Certificate Validation vulnerability in LibreOffice existed where determining if a macro was signed by a trusted author was done by only matching the serial number and issuer string of the used certificate with that of a trusted certificate. This is not sufficient to verify that the macro was actually signed with the certificate. An adversary could therefore create an arbitrary certificate with a serial number and an issuer string identical to a trusted certificate which LibreOffice would present as belonging to the trusted author, potentially leading to the user to execute arbitrary code contained in macros improperly trusted. This issue affects: The Document Foundation LibreOffice 7.2 versions prior to 7.2.7; 7.3 versions prior to 7.3.1.

Опубликовано: 2022-07-25Изменено: 2024-11-21
CVSS 3.xВЫСОКАЯ 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Ссылки

Закрытые ошибки (3)

Ошибка #41969

LibreOffice Math: не вставляются специальные символы