Debian has issued an advisory today (February 11): https://www.debian.org/security/2018/dsa-4111 The upstream advisory (with a rejected duplicate CVE) is here: https://www.libreoffice.org/about-us/security/advisories/cve-2018-1055/ The issue is fixed upstream in 5.4.5 and 6.0.1. Mageia 6 is also affected.
CC: (none) => thierry.vignaudWhiteboard: (none) => MGA6TOOStatus comment: (none) => Fixed upstream in 5.4.5 and Debian has a patch
Fedora has issued an advisory for this on February 20: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/D4MAIHIDCJDP46QIPC5NIWH6MGNX62J7/ We should sync Mageia 6 with Fedora 26 (LO 5.3.x).
Subsequent updates in Cauldron have fixed the known issues. Debian has issued an advisory on April 20: https://www.debian.org/security/2018/dsa-4178 It fixes two additional issues, CVE-2018-10119 and CVE-2018-10120. Upstream advisories for those from April 18: https://www.libreoffice.org/about-us/security/advisories/cve-2018-10119/ https://www.libreoffice.org/about-us/security/advisories/cve-2018-10120/ The issues are fixed in 5.4.6.
Summary: libreoffice new security issue CVE-2018-6871 => libreoffice new security issues CVE-2018-6871, CVE-2018-10119, CVE-2018-10120Status comment: Fixed upstream in 5.4.5 and Debian has a patch => Fixed upstream in 5.4.6 and Debian has patchesVersion: Cauldron => 6Whiteboard: MGA6TOO => (none)Source RPM: libreoffice-6.0.0.3-1.mga7.src.rpm => libreoffice-5.3.4.2-3.mga6.src.rpm
I updated the package to sync Mageia 6 with Fedora 26 (LO 5.3.7.2 with fixes for CVE-2018-6871, CVE-2018-10119 and CVE-2018-10120) but the build failed because of the timeout.
CC: (none) => nicolas.salguero
Suggested advisory: ======================== The updated packages fix security vulnerabilities: LibreOffice before 5.4.5 and 6.x before 6.0.1 allows remote attackers to read arbitrary files via =WEBSERVICE calls in a document, which use the COM.MICROSOFT.WEBSERVICE function. (CVE-2018-6871) sot/source/sdstor/stgstrms.cxx in LibreOffice before 5.4.5.1 and 6.x before 6.0.1.1 uses an incorrect integer data type in the StgSmallStrm class, which allows remote attackers to cause a denial of service (use-after-free with write access) or possibly have unspecified other impact via a crafted document that uses the structured storage ole2 wrapper file format. (CVE-2018-10119) The SwCTBWrapper::Read function in sw/source/filter/ww8/ww8toolbar.cxx in LibreOffice before 5.4.6.1 and 6.x before 6.0.2.1 does not validate a customizations index, which allows remote attackers to cause a denial of service (heap-based buffer overflow with write access) or possibly have unspecified other impact via a crafted document that contains a certain Microsoft Word record. (CVE-2018-10120) References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6871 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10119 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10120 https://www.libreoffice.org/about-us/security/advisories/cve-2018-1055/ https://www.libreoffice.org/about-us/security/advisories/cve-2018-10119/ https://www.libreoffice.org/about-us/security/advisories/cve-2018-10120/ https://www.debian.org/security/2018/dsa-4111 https://www.debian.org/security/2018/dsa-4178 ======================== Updated package in core/updates_testing: ======================== libreoffice-5.3.7.2-2.mga6 libreoffice-filters-5.3.7.2-2.mga6 libreoffice-core-5.3.7.2-2.mga6 libreoffice-pyuno-5.3.7.2-2.mga6 libreoffice-base-5.3.7.2-2.mga6 libreoffice-bsh-5.3.7.2-2.mga6 libreoffice-officebean-5.3.7.2-2.mga6 libreoffice-officebean-common-5.3.7.2-2.mga6 libreoffice-rhino-5.3.7.2-2.mga6 libreoffice-wiki-publisher-5.3.7.2-2.mga6 libreoffice-nlpsolver-5.3.7.2-2.mga6 libreoffice-ogltrans-5.3.7.2-2.mga6 libreoffice-pdfimport-5.3.7.2-2.mga6 libreoffice-opensymbol-fonts-5.3.7.2-2.mga6 libreoffice-writer-5.3.7.2-2.mga6 libreoffice-emailmerge-5.3.7.2-2.mga6 libreoffice-calc-5.3.7.2-2.mga6 libreoffice-draw-5.3.7.2-2.mga6 libreoffice-impress-5.3.7.2-2.mga6 libreoffice-math-5.3.7.2-2.mga6 libreoffice-graphicfilter-5.3.7.2-2.mga6 libreoffice-xsltfilter-5.3.7.2-2.mga6 libreoffice-postgresql-5.3.7.2-2.mga6 libreoffice-ure-5.3.7.2-2.mga6 libreoffice-ure-common-5.3.7.2-2.mga6 libreoffice-sdk-5.3.7.2-2.mga6 libreoffice-sdk-doc-5.3.7.2-2.mga6 libreoffice-glade-5.3.7.2-2.mga6 libreoffice-librelogo-5.3.7.2-2.mga6 libreoffice-data-5.3.7.2-2.mga6 libreoffice-x11-5.3.7.2-2.mga6 libreoffice-gtk2-5.3.7.2-2.mga6 libreoffice-gtk3-5.3.7.2-2.mga6 libreoffice-kde4-5.3.7.2-2.mga6 libreofficekit-5.3.7.2-2.mga6 libreofficekit-devel-5.3.7.2-2.mga6 libreoffice-gdb-debug-support-5.3.7.2-2.mga6 libreoffice-langpack-en-5.3.7.2-2.mga6 libreoffice-langpack-af-5.3.7.2-2.mga6 libreoffice-langpack-ar-5.3.7.2-2.mga6 libreoffice-langpack-as-5.3.7.2-2.mga6 libreoffice-langpack-bg-5.3.7.2-2.mga6 libreoffice-langpack-bn-5.3.7.2-2.mga6 libreoffice-langpack-br-5.3.7.2-2.mga6 libreoffice-langpack-ca-5.3.7.2-2.mga6 libreoffice-langpack-cs-5.3.7.2-2.mga6 libreoffice-langpack-cy-5.3.7.2-2.mga6 libreoffice-langpack-da-5.3.7.2-2.mga6 libreoffice-langpack-de-5.3.7.2-2.mga6 libreoffice-langpack-dz-5.3.7.2-2.mga6 libreoffice-langpack-el-5.3.7.2-2.mga6 libreoffice-langpack-es-5.3.7.2-2.mga6 libreoffice-langpack-et-5.3.7.2-2.mga6 libreoffice-langpack-eu-5.3.7.2-2.mga6 libreoffice-langpack-fa-5.3.7.2-2.mga6 libreoffice-langpack-fi-5.3.7.2-2.mga6 libreoffice-langpack-fr-5.3.7.2-2.mga6 libreoffice-langpack-ga-5.3.7.2-2.mga6 libreoffice-langpack-gl-5.3.7.2-2.mga6 libreoffice-langpack-gu-5.3.7.2-2.mga6 libreoffice-langpack-he-5.3.7.2-2.mga6 libreoffice-langpack-hi-5.3.7.2-2.mga6 libreoffice-langpack-hr-5.3.7.2-2.mga6 libreoffice-langpack-hu-5.3.7.2-2.mga6 libreoffice-langpack-id-5.3.7.2-2.mga6 libreoffice-langpack-it-5.3.7.2-2.mga6 libreoffice-langpack-ja-5.3.7.2-2.mga6 libreoffice-langpack-kk-5.3.7.2-2.mga6 libreoffice-langpack-kn-5.3.7.2-2.mga6 libreoffice-langpack-ko-5.3.7.2-2.mga6 libreoffice-langpack-lt-5.3.7.2-2.mga6 libreoffice-langpack-lv-5.3.7.2-2.mga6 libreoffice-langpack-mai-5.3.7.2-2.mga6 libreoffice-langpack-ml-5.3.7.2-2.mga6 libreoffice-langpack-mr-5.3.7.2-2.mga6 libreoffice-langpack-nb-5.3.7.2-2.mga6 libreoffice-langpack-nl-5.3.7.2-2.mga6 libreoffice-langpack-nn-5.3.7.2-2.mga6 libreoffice-langpack-nr-5.3.7.2-2.mga6 libreoffice-langpack-nso-5.3.7.2-2.mga6 libreoffice-langpack-or-5.3.7.2-2.mga6 libreoffice-langpack-pa-5.3.7.2-2.mga6 libreoffice-langpack-pl-5.3.7.2-2.mga6 libreoffice-langpack-pt_BR-5.3.7.2-2.mga6 libreoffice-langpack-pt-5.3.7.2-2.mga6 libreoffice-langpack-ro-5.3.7.2-2.mga6 libreoffice-langpack-ru-5.3.7.2-2.mga6 libreoffice-langpack-si-5.3.7.2-2.mga6 libreoffice-langpack-sk-5.3.7.2-2.mga6 libreoffice-langpack-sl-5.3.7.2-2.mga6 libreoffice-langpack-sr-5.3.7.2-2.mga6 libreoffice-langpack-ss-5.3.7.2-2.mga6 libreoffice-langpack-st-5.3.7.2-2.mga6 libreoffice-langpack-sv-5.3.7.2-2.mga6 libreoffice-langpack-ta-5.3.7.2-2.mga6 libreoffice-langpack-te-5.3.7.2-2.mga6 libreoffice-langpack-th-5.3.7.2-2.mga6 libreoffice-langpack-tn-5.3.7.2-2.mga6 libreoffice-langpack-tr-5.3.7.2-2.mga6 libreoffice-langpack-ts-5.3.7.2-2.mga6 libreoffice-langpack-uk-5.3.7.2-2.mga6 libreoffice-langpack-ve-5.3.7.2-2.mga6 libreoffice-langpack-xh-5.3.7.2-2.mga6 libreoffice-langpack-zh_CN-5.3.7.2-2.mga6 libreoffice-langpack-zh_TW-5.3.7.2-2.mga6 libreoffice-langpack-zu-5.3.7.2-2.mga6 autocorr-en-5.3.7.2-2.mga6 autocorr-af-5.3.7.2-2.mga6 autocorr-bg-5.3.7.2-2.mga6 autocorr-ca-5.3.7.2-2.mga6 autocorr-cs-5.3.7.2-2.mga6 autocorr-da-5.3.7.2-2.mga6 autocorr-de-5.3.7.2-2.mga6 autocorr-es-5.3.7.2-2.mga6 autocorr-fa-5.3.7.2-2.mga6 autocorr-fi-5.3.7.2-2.mga6 autocorr-fr-5.3.7.2-2.mga6 autocorr-ga-5.3.7.2-2.mga6 autocorr-hr-5.3.7.2-2.mga6 autocorr-hu-5.3.7.2-2.mga6 autocorr-is-5.3.7.2-2.mga6 autocorr-it-5.3.7.2-2.mga6 autocorr-ja-5.3.7.2-2.mga6 autocorr-ko-5.3.7.2-2.mga6 autocorr-lb-5.3.7.2-2.mga6 autocorr-lt-5.3.7.2-2.mga6 autocorr-mn-5.3.7.2-2.mga6 autocorr-nl-5.3.7.2-2.mga6 autocorr-pl-5.3.7.2-2.mga6 autocorr-pt-5.3.7.2-2.mga6 autocorr-ro-5.3.7.2-2.mga6 autocorr-ru-5.3.7.2-2.mga6 autocorr-sk-5.3.7.2-2.mga6 autocorr-sl-5.3.7.2-2.mga6 autocorr-sr-5.3.7.2-2.mga6 autocorr-sv-5.3.7.2-2.mga6 autocorr-tr-5.3.7.2-2.mga6 autocorr-vi-5.3.7.2-2.mga6 autocorr-zh-5.3.7.2-2.mga6 from SRPMS: libreoffice-5.3.7.2-2.mga6.src.rpm
Status: NEW => ASSIGNEDAssignee: pkg-bugs => qa-bugsCVE: (none) => CVE-2018-6871, CVE-2018-10119, CVE-2018-10120
For CVE-2018-6871 there is a file which purports to provide an exploit. https://www.exploit-db.com/exploits/44022/ This has a file called poc.fods which is XML and looks like it is intended to be embedded in another document, presumably a calc files. I have zero knowledge of spreadsheets so would appreciate a pointer to how this can be embedded. Simply importing it under libreoffice --calc raises a "General data error". Is it meant to go into a cell or what and how would you do that?
CC: (none) => tarazed25
I use Calc quite a bit, but only in the simplest of fashion. I categorize things having to do with the farm, sum them up, and sum up the categories. I don't do any embedding. Wouldn't know how to begin. But, for the things that I use it, Calc shows no regressions from this update.
CC: (none) => andrewsfarm
Is there a patch for CVE-2018-10583 for 5.3.x? https://www.libreoffice.org/about-us/security/advisories/cve-2018-10583/
Keywords: (none) => feedback
Using Writer to test the autocorr-es and lagnuague pack - es No issues detected I can add images, diagrams with the diagram assistant, and can make tables and text boxes....for me the language pack and the autocorr in spanish language is OK
CC: (none) => neoser10
(In reply to David Walser from comment #7) > Is there a patch for CVE-2018-10583 for 5.3.x? > > https://www.libreoffice.org/about-us/security/advisories/cve-2018-10583/ There was no patch from fedora but the following commit https://cgit.freedesktop.org/libreoffice/core/commit/?id=0b7f4a4f57117fde33d0b1df96134aa6ccce023e (referenced by https://security-tracker.debian.org/tracker/CVE-2018-10583) almost cleanly applied so I added it. To solve CVE-2018-10583, the user also need to go to : "Tools->Options->Security->Options->Block any links from documents not among the trusted locations" in a version that contains the patch mentioned above. I tested locally: 1) I built a patched version of libreoffice. 2) I created a POC (http://secureyourit.co.uk/wp/2018/05/01/creating-malicious-odt-files/) Result: only with the patched version and the configuration made, the distant image was blocked, otherwise the distant image was loaded.
Suggested advisory: ======================== The updated packages fix security vulnerabilities: LibreOffice before 5.4.5 and 6.x before 6.0.1 allows remote attackers to read arbitrary files via =WEBSERVICE calls in a document, which use the COM.MICROSOFT.WEBSERVICE function. (CVE-2018-6871) sot/source/sdstor/stgstrms.cxx in LibreOffice before 5.4.5.1 and 6.x before 6.0.1.1 uses an incorrect integer data type in the StgSmallStrm class, which allows remote attackers to cause a denial of service (use-after-free with write access) or possibly have unspecified other impact via a crafted document that uses the structured storage ole2 wrapper file format. (CVE-2018-10119) The SwCTBWrapper::Read function in sw/source/filter/ww8/ww8toolbar.cxx in LibreOffice before 5.4.6.1 and 6.x before 6.0.2.1 does not validate a customizations index, which allows remote attackers to cause a denial of service (heap-based buffer overflow with write access) or possibly have unspecified other impact via a crafted document that contains a certain Microsoft Word record. (CVE-2018-10120) An information disclosure vulnerability occurs when LibreOffice 6.0.3 and Apache OpenOffice Writer 4.1.5 automatically process and initiate an SMB connection embedded in a malicious file, as demonstrated by xlink:href=file://192.168.0.2/test.jpg within an office:document-content element in a .odt XML document. (CVE-2018-10583) References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6871 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10119 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10120 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10583 https://www.libreoffice.org/about-us/security/advisories/cve-2018-1055/ https://www.libreoffice.org/about-us/security/advisories/cve-2018-10119/ https://www.libreoffice.org/about-us/security/advisories/cve-2018-10120/ https://www.libreoffice.org/about-us/security/advisories/cve-2018-10583/ https://www.debian.org/security/2018/dsa-4111 https://www.debian.org/security/2018/dsa-4178 ======================== Updated package in core/updates_testing: ======================== libreoffice-5.3.7.2-3.mga6 libreoffice-filters-5.3.7.2-3.mga6 libreoffice-core-5.3.7.2-3.mga6 libreoffice-pyuno-5.3.7.2-3.mga6 libreoffice-base-5.3.7.2-3.mga6 libreoffice-bsh-5.3.7.2-3.mga6 libreoffice-officebean-5.3.7.2-3.mga6 libreoffice-officebean-common-5.3.7.2-3.mga6 libreoffice-rhino-5.3.7.2-3.mga6 libreoffice-wiki-publisher-5.3.7.2-3.mga6 libreoffice-nlpsolver-5.3.7.2-3.mga6 libreoffice-ogltrans-5.3.7.2-3.mga6 libreoffice-pdfimport-5.3.7.2-3.mga6 libreoffice-opensymbol-fonts-5.3.7.2-3.mga6 libreoffice-writer-5.3.7.2-3.mga6 libreoffice-emailmerge-5.3.7.2-3.mga6 libreoffice-calc-5.3.7.2-3.mga6 libreoffice-draw-5.3.7.2-3.mga6 libreoffice-impress-5.3.7.2-3.mga6 libreoffice-math-5.3.7.2-3.mga6 libreoffice-graphicfilter-5.3.7.2-3.mga6 libreoffice-xsltfilter-5.3.7.2-3.mga6 libreoffice-postgresql-5.3.7.2-3.mga6 libreoffice-ure-5.3.7.2-3.mga6 libreoffice-ure-common-5.3.7.2-3.mga6 libreoffice-sdk-5.3.7.2-3.mga6 libreoffice-sdk-doc-5.3.7.2-3.mga6 libreoffice-glade-5.3.7.2-3.mga6 libreoffice-librelogo-5.3.7.2-3.mga6 libreoffice-data-5.3.7.2-3.mga6 libreoffice-x11-5.3.7.2-3.mga6 libreoffice-gtk2-5.3.7.2-3.mga6 libreoffice-gtk3-5.3.7.2-3.mga6 libreoffice-kde4-5.3.7.2-3.mga6 libreofficekit-5.3.7.2-3.mga6 libreofficekit-devel-5.3.7.2-3.mga6 libreoffice-gdb-debug-support-5.3.7.2-3.mga6 libreoffice-langpack-en-5.3.7.2-3.mga6 libreoffice-langpack-af-5.3.7.2-3.mga6 libreoffice-langpack-ar-5.3.7.2-3.mga6 libreoffice-langpack-as-5.3.7.2-3.mga6 libreoffice-langpack-bg-5.3.7.2-3.mga6 libreoffice-langpack-bn-5.3.7.2-3.mga6 libreoffice-langpack-br-5.3.7.2-3.mga6 libreoffice-langpack-ca-5.3.7.2-3.mga6 libreoffice-langpack-cs-5.3.7.2-3.mga6 libreoffice-langpack-cy-5.3.7.2-3.mga6 libreoffice-langpack-da-5.3.7.2-3.mga6 libreoffice-langpack-de-5.3.7.2-3.mga6 libreoffice-langpack-dz-5.3.7.2-3.mga6 libreoffice-langpack-el-5.3.7.2-3.mga6 libreoffice-langpack-es-5.3.7.2-3.mga6 libreoffice-langpack-et-5.3.7.2-3.mga6 libreoffice-langpack-eu-5.3.7.2-3.mga6 libreoffice-langpack-fa-5.3.7.2-3.mga6 libreoffice-langpack-fi-5.3.7.2-3.mga6 libreoffice-langpack-fr-5.3.7.2-3.mga6 libreoffice-langpack-ga-5.3.7.2-3.mga6 libreoffice-langpack-gl-5.3.7.2-3.mga6 libreoffice-langpack-gu-5.3.7.2-3.mga6 libreoffice-langpack-he-5.3.7.2-3.mga6 libreoffice-langpack-hi-5.3.7.2-3.mga6 libreoffice-langpack-hr-5.3.7.2-3.mga6 libreoffice-langpack-hu-5.3.7.2-3.mga6 libreoffice-langpack-id-5.3.7.2-3.mga6 libreoffice-langpack-it-5.3.7.2-3.mga6 libreoffice-langpack-ja-5.3.7.2-3.mga6 libreoffice-langpack-kk-5.3.7.2-3.mga6 libreoffice-langpack-kn-5.3.7.2-3.mga6 libreoffice-langpack-ko-5.3.7.2-3.mga6 libreoffice-langpack-lt-5.3.7.2-3.mga6 libreoffice-langpack-lv-5.3.7.2-3.mga6 libreoffice-langpack-mai-5.3.7.2-3.mga6 libreoffice-langpack-ml-5.3.7.2-3.mga6 libreoffice-langpack-mr-5.3.7.2-3.mga6 libreoffice-langpack-nb-5.3.7.2-3.mga6 libreoffice-langpack-nl-5.3.7.2-3.mga6 libreoffice-langpack-nn-5.3.7.2-3.mga6 libreoffice-langpack-nr-5.3.7.2-3.mga6 libreoffice-langpack-nso-5.3.7.2-3.mga6 libreoffice-langpack-or-5.3.7.2-3.mga6 libreoffice-langpack-pa-5.3.7.2-3.mga6 libreoffice-langpack-pl-5.3.7.2-3.mga6 libreoffice-langpack-pt_BR-5.3.7.2-3.mga6 libreoffice-langpack-pt-5.3.7.2-3.mga6 libreoffice-langpack-ro-5.3.7.2-3.mga6 libreoffice-langpack-ru-5.3.7.2-3.mga6 libreoffice-langpack-si-5.3.7.2-3.mga6 libreoffice-langpack-sk-5.3.7.2-3.mga6 libreoffice-langpack-sl-5.3.7.2-3.mga6 libreoffice-langpack-sr-5.3.7.2-3.mga6 libreoffice-langpack-ss-5.3.7.2-3.mga6 libreoffice-langpack-st-5.3.7.2-3.mga6 libreoffice-langpack-sv-5.3.7.2-3.mga6 libreoffice-langpack-ta-5.3.7.2-3.mga6 libreoffice-langpack-te-5.3.7.2-3.mga6 libreoffice-langpack-th-5.3.7.2-3.mga6 libreoffice-langpack-tn-5.3.7.2-3.mga6 libreoffice-langpack-tr-5.3.7.2-3.mga6 libreoffice-langpack-ts-5.3.7.2-3.mga6 libreoffice-langpack-uk-5.3.7.2-3.mga6 libreoffice-langpack-ve-5.3.7.2-3.mga6 libreoffice-langpack-xh-5.3.7.2-3.mga6 libreoffice-langpack-zh_CN-5.3.7.2-3.mga6 libreoffice-langpack-zh_TW-5.3.7.2-3.mga6 libreoffice-langpack-zu-5.3.7.2-3.mga6 autocorr-en-5.3.7.2-3.mga6 autocorr-af-5.3.7.2-3.mga6 autocorr-bg-5.3.7.2-3.mga6 autocorr-ca-5.3.7.2-3.mga6 autocorr-cs-5.3.7.2-3.mga6 autocorr-da-5.3.7.2-3.mga6 autocorr-de-5.3.7.2-3.mga6 autocorr-es-5.3.7.2-3.mga6 autocorr-fa-5.3.7.2-3.mga6 autocorr-fi-5.3.7.2-3.mga6 autocorr-fr-5.3.7.2-3.mga6 autocorr-ga-5.3.7.2-3.mga6 autocorr-hr-5.3.7.2-3.mga6 autocorr-hu-5.3.7.2-3.mga6 autocorr-is-5.3.7.2-3.mga6 autocorr-it-5.3.7.2-3.mga6 autocorr-ja-5.3.7.2-3.mga6 autocorr-ko-5.3.7.2-3.mga6 autocorr-lb-5.3.7.2-3.mga6 autocorr-lt-5.3.7.2-3.mga6 autocorr-mn-5.3.7.2-3.mga6 autocorr-nl-5.3.7.2-3.mga6 autocorr-pl-5.3.7.2-3.mga6 autocorr-pt-5.3.7.2-3.mga6 autocorr-ro-5.3.7.2-3.mga6 autocorr-ru-5.3.7.2-3.mga6 autocorr-sk-5.3.7.2-3.mga6 autocorr-sl-5.3.7.2-3.mga6 autocorr-sr-5.3.7.2-3.mga6 autocorr-sv-5.3.7.2-3.mga6 autocorr-tr-5.3.7.2-3.mga6 autocorr-vi-5.3.7.2-3.mga6 autocorr-zh-5.3.7.2-3.mga6 from SRPMS: libreoffice-5.3.7.2-3.mga6.src.rpm
CVE: CVE-2018-6871, CVE-2018-10119, CVE-2018-10120 => CVE-2018-6871, CVE-2018-10119, CVE-2018-10120, CVE-2018-10583Keywords: feedback => (none)Summary: libreoffice new security issues CVE-2018-6871, CVE-2018-10119, CVE-2018-10120 => libreoffice new security issues CVE-2018-6871, CVE-2018-10119, CVE-2018-10120, CVE-2018-10583
MGA6-32 on IBM Thinkpad R50e MATE No installation issues. Opened odt, ods, xlxs, odb and odp files OK.
Whiteboard: (none) => MGA6-32-OKCC: (none) => herman.viaene
Could do with 64bit tests for this one too.
MGA6-64 on workstation Intel i7 Swedish localisation. No installation issues. Quick test of small previous self made documents: opened odt, odg, ods, exported as pdf, and printed OK.
CC: (none) => friWhiteboard: MGA6-32-OK => MGA6-32-OK MGA6-64-OK
Touché!
Good job Morgan. Can you do Gimp too?
Keywords: (none) => validated_updateCC: (none) => sysadmin-bugs
Advisory added from comment 10
Keywords: (none) => advisory
Tested in i586, the previous version start to corrupt xslx files after the Grand Update. The issue persist in this version. I don't know how to debug this issue, the corruption consist in one of this a)Duplicated object names (filters and print areas i think) you have to assing unique id to keep the format, if you only close the windows complaining about this you lost all the format. b)The file lost some objects (filters). May be is a issue for other report?
Forget to say, the corruption is present when you open a xslx file saved by lo in mso, but if you open the "corrupted" xslx in lo (not saving the changes if you make the reparations in mso) the file is good :S
Regarding comment 17, have you searched upstream for any bug reports or user forum thread mentioning this issue? Libreoffice was not part of the Grand Update ( Plasma, KDE, Qt5, KF5, and related, Bug 22656 ) I wonder what that LO depends on changed...? Have you tested to downgrade Libreoffice to an earlier version, some time before Grand Update? Yes a separate bug number is preferred.
An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2018-0271.html
Resolution: (none) => FIXEDStatus: ASSIGNED => RESOLVED
Fedora advisory for CVE-2018-10583 from May 11: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/P4YUFHNLH3PEZVUJ3QPTRELT2NZQRF6M/