Bug 17789 - libreoffice new security issues CVE-2016-0794 and CVE-2016-0795
Summary: libreoffice new security issues CVE-2016-0794 and CVE-2016-0795
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 5
Hardware: All Linux
Priority: Normal major
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL: http://lwn.net/Vulnerabilities/676108/
Whiteboard: has_procedure advisory MGA5-32-OK MGA...
Keywords: validated_update
Depends on:
Blocks:
 
Reported: 2016-02-17 16:35 CET by David Walser
Modified: 2016-05-22 00:12 CEST (History)
3 users (show)

See Also:
Source RPM: libreoffice-4.4.7.2-2.mga5.src.rpm
CVE:
Status comment:


Attachments

Description David Walser 2016-02-17 16:35:18 CET
Upstream has issued advisories today (February 17):
https://www.libreoffice.org/about-us/security/advisories/cve-2016-0794/
https://www.libreoffice.org/about-us/security/advisories/cve-2016-0795/

Older versions of LibreOffice are also affected.

Ubuntu has issued an advisory for this on February 16:
http://www.ubuntu.com/usn/usn-2899-1/

Reproducible: 

Steps to Reproduce:
David Walser 2016-02-17 20:47:31 CET

URL: (none) => http://lwn.net/Vulnerabilities/676108/

Comment 1 David Walser 2016-02-29 22:33:57 CET
Fedora now has fixes backported to 4.4.7.  Their advisory from February 28:
https://lists.fedoraproject.org/pipermail/package-announce/2016-February/178036.html
Comment 2 David Walser 2016-05-18 22:03:01 CEST
Pinging Thierry.  Could we update LO and the supporting libraries please?
Comment 3 Thierry Vignaud 2016-05-18 22:23:44 CEST
err...
We already got libreoffice-4.4.7 in core/updates...
Since January...
I wrote the advisory one month and half before this ticket was opened...

*** This bug has been marked as a duplicate of bug 17454 ***

Status: NEW => RESOLVED
Resolution: (none) => DUPLICATE

Comment 4 David Walser 2016-05-18 23:19:28 CEST
Sigh...

Please read more carefully.  Fedora *backported* fixes to 4.4.7 (3 months after updating to 4.4.7).  These issues are not fixed.

Status: RESOLVED => REOPENED
Resolution: DUPLICATE => (none)

Comment 5 Thierry Vignaud 2016-05-19 08:15:33 CEST
LO submitted

Source RPM: libreoffice-4.4.7.2-1.mga5.src.rpm => libreoffice-4.4.7.2-2.mga5.src.rpm

Comment 6 David Walser 2016-05-19 13:43:38 CEST
Thanks!

Advisory:
========================

Updated libreoffice packages fix security vulnerabilities:

The lwp filter in LibreOffice before 5.0.4 allows remote attackers to cause a
denial of service (memory corruption) or possibly have unspecified other impact
via a crafted LotusWordPro (lwp) document (CVE-2016-0794).

LibreOffice before 5.0.5 allows remote attackers to cause a denial of service
(memory corruption) or possibly have unspecified other impact via a crafted
LwpTocSuperLayout record in a LotusWordPro (lwp) document (CVE-2016-0795).

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0794
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0795
https://www.libreoffice.org/about-us/security/advisories/cve-2016-0794/
https://www.libreoffice.org/about-us/security/advisories/cve-2016-0795/
https://lists.fedoraproject.org/pipermail/package-announce/2016-February/178036.html
========================

Updated packages in core/updates_testing:
========================libreoffice-4.4.7.2-2.mga5
libreoffice-base-4.4.7.2-2.mga5
libreoffice-bsh-4.4.7.2-2.mga5
libreoffice-calc-4.4.7.2-2.mga5
libreoffice-core-4.4.7.2-2.mga5
libreoffice-draw-4.4.7.2-2.mga5
libreoffice-emailmerge-4.4.7.2-2.mga5
libreoffice-filters-4.4.7.2-2.mga5
libreoffice-glade-4.4.7.2-2.mga5
libreoffice-graphicfilter-4.4.7.2-2.mga5
libreoffice-impress-4.4.7.2-2.mga5
libreoffice-java-common-4.4.7.2-2.mga5
libreoffice-kde-4.4.7.2-2.mga5
libreoffice-langpack-af-4.4.7.2-2.mga5
libreoffice-langpack-ar-4.4.7.2-2.mga5
libreoffice-langpack-as-4.4.7.2-2.mga5
libreoffice-langpack-bg-4.4.7.2-2.mga5
libreoffice-langpack-bn-4.4.7.2-2.mga5
libreoffice-langpack-br-4.4.7.2-2.mga5
libreoffice-langpack-ca-4.4.7.2-2.mga5
libreoffice-langpack-cs-4.4.7.2-2.mga5
libreoffice-langpack-cy-4.4.7.2-2.mga5
libreoffice-langpack-da-4.4.7.2-2.mga5
libreoffice-langpack-de-4.4.7.2-2.mga5
libreoffice-langpack-dz-4.4.7.2-2.mga5
libreoffice-langpack-el-4.4.7.2-2.mga5
libreoffice-langpack-en-4.4.7.2-2.mga5
libreoffice-langpack-es-4.4.7.2-2.mga5
libreoffice-langpack-et-4.4.7.2-2.mga5
libreoffice-langpack-eu-4.4.7.2-2.mga5
libreoffice-langpack-fa-4.4.7.2-2.mga5
libreoffice-langpack-fi-4.4.7.2-2.mga5
libreoffice-langpack-fr-4.4.7.2-2.mga5
libreoffice-langpack-ga-4.4.7.2-2.mga5
libreoffice-langpack-gl-4.4.7.2-2.mga5
libreoffice-langpack-gu-4.4.7.2-2.mga5
libreoffice-langpack-he-4.4.7.2-2.mga5
libreoffice-langpack-hi-4.4.7.2-2.mga5
libreoffice-langpack-hr-4.4.7.2-2.mga5
libreoffice-langpack-hu-4.4.7.2-2.mga5
libreoffice-langpack-it-4.4.7.2-2.mga5
libreoffice-langpack-ja-4.4.7.2-2.mga5
libreoffice-langpack-kk-4.4.7.2-2.mga5
libreoffice-langpack-kn-4.4.7.2-2.mga5
libreoffice-langpack-ko-4.4.7.2-2.mga5
libreoffice-langpack-lt-4.4.7.2-2.mga5
libreoffice-langpack-lv-4.4.7.2-2.mga5
libreoffice-langpack-mai-4.4.7.2-2.mga5
libreoffice-langpack-ml-4.4.7.2-2.mga5
libreoffice-langpack-mr-4.4.7.2-2.mga5
libreoffice-langpack-nb-4.4.7.2-2.mga5
libreoffice-langpack-nl-4.4.7.2-2.mga5
libreoffice-langpack-nn-4.4.7.2-2.mga5
libreoffice-langpack-nr-4.4.7.2-2.mga5
libreoffice-langpack-nso-4.4.7.2-2.mga5
libreoffice-langpack-or-4.4.7.2-2.mga5
libreoffice-langpack-pa-4.4.7.2-2.mga5
libreoffice-langpack-pl-4.4.7.2-2.mga5
libreoffice-langpack-pt-4.4.7.2-2.mga5
libreoffice-langpack-pt_BR-4.4.7.2-2.mga5
libreoffice-langpack-ro-4.4.7.2-2.mga5
libreoffice-langpack-ru-4.4.7.2-2.mga5
libreoffice-langpack-si-4.4.7.2-2.mga5
libreoffice-langpack-sk-4.4.7.2-2.mga5
libreoffice-langpack-sl-4.4.7.2-2.mga5
libreoffice-langpack-sr-4.4.7.2-2.mga5
libreoffice-langpack-ss-4.4.7.2-2.mga5
libreoffice-langpack-st-4.4.7.2-2.mga5
libreoffice-langpack-sv-4.4.7.2-2.mga5
libreoffice-langpack-ta-4.4.7.2-2.mga5
libreoffice-langpack-te-4.4.7.2-2.mga5
libreoffice-langpack-th-4.4.7.2-2.mga5
libreoffice-langpack-tn-4.4.7.2-2.mga5
libreoffice-langpack-tr-4.4.7.2-2.mga5
libreoffice-langpack-ts-4.4.7.2-2.mga5
libreoffice-langpack-uk-4.4.7.2-2.mga5
libreoffice-langpack-ve-4.4.7.2-2.mga5
libreoffice-langpack-xh-4.4.7.2-2.mga5
libreoffice-langpack-zh_CN-4.4.7.2-2.mga5
libreoffice-langpack-zh_TW-4.4.7.2-2.mga5
libreoffice-langpack-zu-4.4.7.2-2.mga5
libreoffice-librelogo-4.4.7.2-2.mga5
libreoffice-math-4.4.7.2-2.mga5
libreoffice-nlpsolver-4.4.7.2-2.mga5
libreoffice-officebean-4.4.7.2-2.mga5
libreoffice-ogltrans-4.4.7.2-2.mga5
libreoffice-pdfimport-4.4.7.2-2.mga5
libreoffice-postgresql-4.4.7.2-2.mga5
libreoffice-pyuno-4.4.7.2-2.mga5
libreoffice-rhino-4.4.7.2-2.mga5
libreoffice-sdk-4.4.7.2-2.mga5
libreoffice-sdk-doc-4.4.7.2-2.mga5
libreoffice-ure-4.4.7.2-2.mga5
libreoffice-wiki-publisher-4.4.7.2-2.mga5
libreoffice-writer-4.4.7.2-2.mga5
libreoffice-xsltfilter-4.4.7.2-2.mga5
autocorr-af-4.4.7.2-2.mga5
autocorr-bg-4.4.7.2-2.mga5
autocorr-ca-4.4.7.2-2.mga5
autocorr-cs-4.4.7.2-2.mga5
autocorr-da-4.4.7.2-2.mga5
autocorr-de-4.4.7.2-2.mga5
autocorr-en-4.4.7.2-2.mga5
autocorr-es-4.4.7.2-2.mga5
autocorr-fa-4.4.7.2-2.mga5
autocorr-fi-4.4.7.2-2.mga5
autocorr-fr-4.4.7.2-2.mga5
autocorr-ga-4.4.7.2-2.mga5
autocorr-hr-4.4.7.2-2.mga5
autocorr-hu-4.4.7.2-2.mga5
autocorr-is-4.4.7.2-2.mga5
autocorr-it-4.4.7.2-2.mga5
autocorr-ja-4.4.7.2-2.mga5
autocorr-ko-4.4.7.2-2.mga5
autocorr-lb-4.4.7.2-2.mga5
autocorr-lt-4.4.7.2-2.mga5
autocorr-mn-4.4.7.2-2.mga5
autocorr-nl-4.4.7.2-2.mga5
autocorr-pl-4.4.7.2-2.mga5
autocorr-pt-4.4.7.2-2.mga5
autocorr-ro-4.4.7.2-2.mga5
autocorr-ru-4.4.7.2-2.mga5
autocorr-sk-4.4.7.2-2.mga5
autocorr-sl-4.4.7.2-2.mga5
autocorr-sr-4.4.7.2-2.mga5
autocorr-sv-4.4.7.2-2.mga5
autocorr-tr-4.4.7.2-2.mga5
autocorr-vi-4.4.7.2-2.mga5
autocorr-zh-4.4.7.2-2.mga5
libreoffice-opensymbol-fonts-4.4.7.2-2.mga5

from libreoffice-4.4.7.2-2.mga5.src.rpm

Assignee: thierry.vignaud => qa-bugs

Comment 7 Thierry Vignaud 2016-05-19 16:41:53 CEST
(In reply to David Walser from comment #4)

Note that:
- 4.4.x is no more supported upstream
- but FC22 still support it (until end of June?)

So at end of June, we might consider rebasing mga5's LO to 5.0.x

CC: (none) => thierry.vignaud
Hardware: i586 => All

Comment 8 David Walser 2016-05-19 17:01:48 CEST
Yes, an update to 5.0.x would be quite welcome.  Hopefully the problem mentioned in Bug 17586 will no longer be an issue.
Comment 9 David Walser 2016-05-20 04:51:23 CEST
Hi Thierry,

I saw that you updated some of the supporting libraries.  Did you want to ship those as part of this update?  If so, you'll need to rebuild libreoffice if you want the libwps update to be included, since it's linked against libwps0.3, but the updated one is libwps0.4.

Packages built:
librevenge0-0.0.4-1.mga5
librevenge-devel-0.0.4-1.mga5
librevenge-doc-0.0.4-1.mga5
libcdr0.1_1-0.1.2-1.mga5
libcdr-devel-0.1.2-1.mga5
libcdr-doc-0.1.2-1.mga5
libcdr-tools-0.1.2-1.mga5
libvisio0.1_1-0.1.5-1.mga5
libvisio-devel-0.1.5-1.mga5
libvisio-doc-0.1.5-1.mga5
libvisio-tools-0.1.5-1.mga5
libwpd-tools-0.10.1-1.mga5
libwpd0.10_10-0.10.1-1.mga5
libwpd-devel-0.10.1-1.mga5
libwps-tools-0.4.3-1.mga5
libwps0.4_4-0.4.3-1.mga5
libwps-devel-0.4.3-1.mga5
libwps-docs-0.4.3-1.mga5

from SRPMS:
librevenge-0.0.4-1.mga5.src.rpm
libcdr-0.1.2-1.mga5.src.rpm
libvisio-0.1.5-1.mga5.src.rpm
libwpd-0.10.1-1.mga5.src.rpm
libwps-0.4.3-1.mga5.src.rpm
Comment 10 Thierry Vignaud 2016-05-20 07:49:24 CEST
No that's for preparing a future LO-5.0.x
Comment 11 David Walser 2016-05-20 16:54:33 CEST
Thanks Thierry.  I thought that might be the case.
Comment 12 David Walser 2016-05-20 16:57:23 CEST
I tested Writer, Calc, and Impress on Mageia 5 i586 and all work fine.

Whiteboard: (none) => MGA5-32-OK

Comment 13 Brian Rockwell 2016-05-20 20:55:24 CEST
mga5-64 - running GNOME

I uninstalled libreoffice 4.4.7.2-1 completely and then installed 4.4.7.2-2.

The following 21 packages are going to be installed:

- lib64gladeui1_11-3.8.5-3.mga5.x86_64
- libreoffice-4.4.7.2-2.mga5.x86_64
- libreoffice-base-4.4.7.2-2.mga5.x86_64
- libreoffice-calc-4.4.7.2-2.mga5.x86_64
- libreoffice-core-4.4.7.2-2.mga5.x86_64
- libreoffice-draw-4.4.7.2-2.mga5.x86_64
- libreoffice-emailmerge-4.4.7.2-2.mga5.x86_64
- libreoffice-filters-4.4.7.2-2.mga5.x86_64
- libreoffice-glade-4.4.7.2-2.mga5.x86_64
- libreoffice-graphicfilter-4.4.7.2-2.mga5.x86_64
- libreoffice-impress-4.4.7.2-2.mga5.x86_64
- libreoffice-java-common-4.4.7.2-2.mga5.x86_64
- libreoffice-langpack-en-4.4.7.2-2.mga5.x86_64
- libreoffice-math-4.4.7.2-2.mga5.x86_64
- libreoffice-ogltrans-4.4.7.2-2.mga5.x86_64
- libreoffice-opensymbol-fonts-4.4.7.2-2.mga5.noarch
- libreoffice-pdfimport-4.4.7.2-2.mga5.x86_64
- libreoffice-pyuno-4.4.7.2-2.mga5.x86_64
- libreoffice-ure-4.4.7.2-2.mga5.x86_64
- libreoffice-writer-4.4.7.2-2.mga5.x86_64
- libreoffice-xsltfilter-4.4.7.2-2.mga5.x86_64

Tested password protected documents, xlsx, odt, pptx and docx as well as some ods documents.  Seems to be working properly.

CC: (none) => brtians1
Whiteboard: MGA5-32-OK => MGA5-32-OK MGA5-64-OK

claire robinson 2016-05-21 21:15:31 CEST

Keywords: (none) => validated_update
Whiteboard: MGA5-32-OK MGA5-64-OK => has_procedure advisory MGA5-32-OK MGA5-64-OK
CC: (none) => sysadmin-bugs

Comment 14 Mageia Robot 2016-05-22 00:12:05 CEST
An update for this issue has been pushed to the Mageia Updates repository.

http://advisories.mageia.org/MGASA-2016-0194.html

Status: REOPENED => RESOLVED
Resolution: (none) => FIXED


Note You need to log in before you can comment on or make changes to this bug.