Bug 32042 - libreoffice new security issue CVE-2023-1183
Summary: libreoffice new security issue CVE-2023-1183
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 8
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA8-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2023-06-22 20:51 CEST by David Walser
Modified: 2023-07-07 07:56 CEST (History)
7 users (show)

See Also:
Source RPM: libreoffice-7.4.5.1-1.1.mga8.src.rpm
CVE:
Status comment:


Attachments

Description David Walser 2023-06-22 20:51:16 CEST
LibreOffice has issued an advisory on June 19:
https://www.libreoffice.org/about-us/security/advisories/cve-2023-1183/

Apparently it's using a bundled hsqldb (Bug 31068).

The issue is fixed upstream in 7.4.6.
David Walser 2023-06-22 20:54:21 CEST

Status comment: (none) => Fixed upstream in 7.4.6

Comment 1 Lewis Smith 2023-06-22 20:58:04 CEST
ns80 looks to be the current principle maintainer of LibreOffice, so assigning this to you

Assignee: bugsquad => nicolas.salguero

Comment 2 Nicolas Salguero 2023-06-28 09:57:09 CEST
Suggested advisory:
========================

The updated packages fix a security vulnerability:

Arbitrary File Write in hsqldb 1.8.0. (CVE-2023-1183)

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1183
https://www.libreoffice.org/about-us/security/advisories/cve-2023-1183/
========================

Updated packages in core/updates_testing:
========================
autocorr-af-7.4.5.1-1.2.mga8
autocorr-bg-7.4.5.1-1.2.mga8
autocorr-ca-7.4.5.1-1.2.mga8
autocorr-cs-7.4.5.1-1.2.mga8
autocorr-da-7.4.5.1-1.2.mga8
autocorr-de-7.4.5.1-1.2.mga8
autocorr-dsb-7.4.5.1-1.2.mga8
autocorr-el-7.4.5.1-1.2.mga8
autocorr-en-7.4.5.1-1.2.mga8
autocorr-es-7.4.5.1-1.2.mga8
autocorr-fa-7.4.5.1-1.2.mga8
autocorr-fi-7.4.5.1-1.2.mga8
autocorr-fr-7.4.5.1-1.2.mga8
autocorr-ga-7.4.5.1-1.2.mga8
autocorr-hr-7.4.5.1-1.2.mga8
autocorr-hsb-7.4.5.1-1.2.mga8
autocorr-hu-7.4.5.1-1.2.mga8
autocorr-is-7.4.5.1-1.2.mga8
autocorr-it-7.4.5.1-1.2.mga8
autocorr-ja-7.4.5.1-1.2.mga8
autocorr-ko-7.4.5.1-1.2.mga8
autocorr-lb-7.4.5.1-1.2.mga8
autocorr-lt-7.4.5.1-1.2.mga8
autocorr-mn-7.4.5.1-1.2.mga8
autocorr-nl-7.4.5.1-1.2.mga8
autocorr-pl-7.4.5.1-1.2.mga8
autocorr-pt-7.4.5.1-1.2.mga8
autocorr-ro-7.4.5.1-1.2.mga8
autocorr-ru-7.4.5.1-1.2.mga8
autocorr-sk-7.4.5.1-1.2.mga8
autocorr-sl-7.4.5.1-1.2.mga8
autocorr-sr-7.4.5.1-1.2.mga8
autocorr-sv-7.4.5.1-1.2.mga8
autocorr-tr-7.4.5.1-1.2.mga8
autocorr-vi-7.4.5.1-1.2.mga8
autocorr-vro-7.4.5.1-1.2.mga8
autocorr-zh-7.4.5.1-1.2.mga8
libreoffice-7.4.5.1-1.2.mga8
libreoffice-base-7.4.5.1-1.2.mga8
libreoffice-calc-7.4.5.1-1.2.mga8
libreoffice-core-7.4.5.1-1.2.mga8
libreoffice-data-7.4.5.1-1.2.mga8
libreoffice-draw-7.4.5.1-1.2.mga8
libreoffice-emailmerge-7.4.5.1-1.2.mga8
libreoffice-filters-7.4.5.1-1.2.mga8
libreoffice-gdb-debug-support-7.4.5.1-1.2.mga8
libreoffice-glade-7.4.5.1-1.2.mga8
libreoffice-graphicfilter-7.4.5.1-1.2.mga8
libreoffice-gtk3-7.4.5.1-1.2.mga8
libreoffice-help-ar-7.4.5.1-1.2.mga8
libreoffice-help-bg-7.4.5.1-1.2.mga8
libreoffice-help-bn-7.4.5.1-1.2.mga8
libreoffice-help-ca-7.4.5.1-1.2.mga8
libreoffice-help-cs-7.4.5.1-1.2.mga8
libreoffice-help-da-7.4.5.1-1.2.mga8
libreoffice-help-de-7.4.5.1-1.2.mga8
libreoffice-help-dz-7.4.5.1-1.2.mga8
libreoffice-help-el-7.4.5.1-1.2.mga8
libreoffice-help-en-7.4.5.1-1.2.mga8
libreoffice-help-eo-7.4.5.1-1.2.mga8
libreoffice-help-es-7.4.5.1-1.2.mga8
libreoffice-help-et-7.4.5.1-1.2.mga8
libreoffice-help-eu-7.4.5.1-1.2.mga8
libreoffice-help-fi-7.4.5.1-1.2.mga8
libreoffice-help-fr-7.4.5.1-1.2.mga8
libreoffice-help-gl-7.4.5.1-1.2.mga8
libreoffice-help-gu-7.4.5.1-1.2.mga8
libreoffice-help-he-7.4.5.1-1.2.mga8
libreoffice-help-hi-7.4.5.1-1.2.mga8
libreoffice-help-hr-7.4.5.1-1.2.mga8
libreoffice-help-hu-7.4.5.1-1.2.mga8
libreoffice-help-id-7.4.5.1-1.2.mga8
libreoffice-help-it-7.4.5.1-1.2.mga8
libreoffice-help-ja-7.4.5.1-1.2.mga8
libreoffice-help-ko-7.4.5.1-1.2.mga8
libreoffice-help-lt-7.4.5.1-1.2.mga8
libreoffice-help-lv-7.4.5.1-1.2.mga8
libreoffice-help-nb-7.4.5.1-1.2.mga8
libreoffice-help-nl-7.4.5.1-1.2.mga8
libreoffice-help-nn-7.4.5.1-1.2.mga8
libreoffice-help-pl-7.4.5.1-1.2.mga8
libreoffice-help-pt-7.4.5.1-1.2.mga8
libreoffice-help-pt_BR-7.4.5.1-1.2.mga8
libreoffice-help-ro-7.4.5.1-1.2.mga8
libreoffice-help-ru-7.4.5.1-1.2.mga8
libreoffice-help-si-7.4.5.1-1.2.mga8
libreoffice-help-sk-7.4.5.1-1.2.mga8
libreoffice-help-sl-7.4.5.1-1.2.mga8
libreoffice-help-sv-7.4.5.1-1.2.mga8
libreoffice-help-ta-7.4.5.1-1.2.mga8
libreoffice-help-tr-7.4.5.1-1.2.mga8
libreoffice-help-uk-7.4.5.1-1.2.mga8
libreoffice-help-zh_CN-7.4.5.1-1.2.mga8
libreoffice-help-zh_TW-7.4.5.1-1.2.mga8
libreoffice-impress-7.4.5.1-1.2.mga8
libreoffice-kf5-7.4.5.1-1.2.mga8
libreofficekit-7.4.5.1-1.2.mga8
libreofficekit-devel-7.4.5.1-1.2.mga8
libreoffice-langpack-af-7.4.5.1-1.2.mga8
libreoffice-langpack-ar-7.4.5.1-1.2.mga8
libreoffice-langpack-as-7.4.5.1-1.2.mga8
libreoffice-langpack-bg-7.4.5.1-1.2.mga8
libreoffice-langpack-bn-7.4.5.1-1.2.mga8
libreoffice-langpack-br-7.4.5.1-1.2.mga8
libreoffice-langpack-ca-7.4.5.1-1.2.mga8
libreoffice-langpack-cs-7.4.5.1-1.2.mga8
libreoffice-langpack-cy-7.4.5.1-1.2.mga8
libreoffice-langpack-da-7.4.5.1-1.2.mga8
libreoffice-langpack-de-7.4.5.1-1.2.mga8
libreoffice-langpack-dz-7.4.5.1-1.2.mga8
libreoffice-langpack-el-7.4.5.1-1.2.mga8
libreoffice-langpack-en-7.4.5.1-1.2.mga8
libreoffice-langpack-eo-7.4.5.1-1.2.mga8
libreoffice-langpack-es-7.4.5.1-1.2.mga8
libreoffice-langpack-et-7.4.5.1-1.2.mga8
libreoffice-langpack-eu-7.4.5.1-1.2.mga8
libreoffice-langpack-fa-7.4.5.1-1.2.mga8
libreoffice-langpack-fi-7.4.5.1-1.2.mga8
libreoffice-langpack-fr-7.4.5.1-1.2.mga8
libreoffice-langpack-fy-7.4.5.1-1.2.mga8
libreoffice-langpack-ga-7.4.5.1-1.2.mga8
libreoffice-langpack-gl-7.4.5.1-1.2.mga8
libreoffice-langpack-gu-7.4.5.1-1.2.mga8
libreoffice-langpack-he-7.4.5.1-1.2.mga8
libreoffice-langpack-hi-7.4.5.1-1.2.mga8
libreoffice-langpack-hr-7.4.5.1-1.2.mga8
libreoffice-langpack-hu-7.4.5.1-1.2.mga8
libreoffice-langpack-id-7.4.5.1-1.2.mga8
libreoffice-langpack-it-7.4.5.1-1.2.mga8
libreoffice-langpack-ja-7.4.5.1-1.2.mga8
libreoffice-langpack-kk-7.4.5.1-1.2.mga8
libreoffice-langpack-kn-7.4.5.1-1.2.mga8
libreoffice-langpack-ko-7.4.5.1-1.2.mga8
libreoffice-langpack-lt-7.4.5.1-1.2.mga8
libreoffice-langpack-lv-7.4.5.1-1.2.mga8
libreoffice-langpack-mai-7.4.5.1-1.2.mga8
libreoffice-langpack-ml-7.4.5.1-1.2.mga8
libreoffice-langpack-mr-7.4.5.1-1.2.mga8
libreoffice-langpack-nb-7.4.5.1-1.2.mga8
libreoffice-langpack-nl-7.4.5.1-1.2.mga8
libreoffice-langpack-nn-7.4.5.1-1.2.mga8
libreoffice-langpack-nr-7.4.5.1-1.2.mga8
libreoffice-langpack-nso-7.4.5.1-1.2.mga8
libreoffice-langpack-or-7.4.5.1-1.2.mga8
libreoffice-langpack-pa-7.4.5.1-1.2.mga8
libreoffice-langpack-pl-7.4.5.1-1.2.mga8
libreoffice-langpack-pt-7.4.5.1-1.2.mga8
libreoffice-langpack-pt_BR-7.4.5.1-1.2.mga8
libreoffice-langpack-ro-7.4.5.1-1.2.mga8
libreoffice-langpack-ru-7.4.5.1-1.2.mga8
libreoffice-langpack-si-7.4.5.1-1.2.mga8
libreoffice-langpack-sk-7.4.5.1-1.2.mga8
libreoffice-langpack-sl-7.4.5.1-1.2.mga8
libreoffice-langpack-sr-7.4.5.1-1.2.mga8
libreoffice-langpack-ss-7.4.5.1-1.2.mga8
libreoffice-langpack-sv-7.4.5.1-1.2.mga8
libreoffice-langpack-ta-7.4.5.1-1.2.mga8
libreoffice-langpack-te-7.4.5.1-1.2.mga8
libreoffice-langpack-th-7.4.5.1-1.2.mga8
libreoffice-langpack-tn-7.4.5.1-1.2.mga8
libreoffice-langpack-tr-7.4.5.1-1.2.mga8
libreoffice-langpack-ts-7.4.5.1-1.2.mga8
libreoffice-langpack-uk-7.4.5.1-1.2.mga8
libreoffice-langpack-ve-7.4.5.1-1.2.mga8
libreoffice-langpack-xh-7.4.5.1-1.2.mga8
libreoffice-langpack-zh_CN-7.4.5.1-1.2.mga8
libreoffice-langpack-zh_TW-7.4.5.1-1.2.mga8
libreoffice-langpack-zu-7.4.5.1-1.2.mga8
libreoffice-librelogo-7.4.5.1-1.2.mga8
libreoffice-math-7.4.5.1-1.2.mga8
libreoffice-nlpsolver-7.4.5.1-1.2.mga8
libreoffice-officebean-7.4.5.1-1.2.mga8
libreoffice-officebean-common-7.4.5.1-1.2.mga8
libreoffice-ogltrans-7.4.5.1-1.2.mga8
libreoffice-opensymbol-fonts-7.4.5.1-1.2.mga8
libreoffice-pdfimport-7.4.5.1-1.2.mga8
libreoffice-postgresql-7.4.5.1-1.2.mga8
libreoffice-pyuno-7.4.5.1-1.2.mga8
libreoffice-sdk-7.4.5.1-1.2.mga8
libreoffice-sdk-doc-7.4.5.1-1.2.mga8
libreoffice-ure-7.4.5.1-1.2.mga8
libreoffice-ure-common-7.4.5.1-1.2.mga8
libreoffice-wiki-publisher-7.4.5.1-1.2.mga8
libreoffice-writer-7.4.5.1-1.2.mga8
libreoffice-x11-7.4.5.1-1.2.mga8
libreoffice-xsltfilter-7.4.5.1-1.2.mga8

from SRPM:
libreoffice-7.4.5.1-1.2.mga8.src.rpm

Status comment: Fixed upstream in 7.4.6 => (none)
Assignee: nicolas.salguero => qa-bugs
CC: (none) => nicolas.salguero
Status: NEW => ASSIGNED

PC LX 2023-06-28 11:53:13 CEST

CC: (none) => mageia

Comment 3 Herman Viaene 2023-06-29 14:37:36 CEST
MGA8-64 MATE on Acer Aspire 5253
No installation issues.
tested file types docx, odt, xlsx, ods, odp, pptx, odb. All work OK except for the reported bug on missing page breaks in odb-reports.
No objection to go.

CC: (none) => herman.viaene

Comment 4 Brian Rockwell 2023-06-29 19:37:13 CEST
MGA8-64

The following 24 packages are going to be installed:

- autocorr-en-7.4.5.1-1.2.mga8.noarch
- libreoffice-7.4.5.1-1.2.mga8.x86_64
- libreoffice-base-7.4.5.1-1.2.mga8.x86_64
- libreoffice-calc-7.4.5.1-1.2.mga8.x86_64
- libreoffice-core-7.4.5.1-1.2.mga8.x86_64
- libreoffice-data-7.4.5.1-1.2.mga8.x86_64
- libreoffice-draw-7.4.5.1-1.2.mga8.x86_64
- libreoffice-emailmerge-7.4.5.1-1.2.mga8.x86_64
- libreoffice-graphicfilter-7.4.5.1-1.2.mga8.x86_64
- libreoffice-gtk3-7.4.5.1-1.2.mga8.x86_64
- libreoffice-help-en-7.4.5.1-1.2.mga8.x86_64
- libreoffice-impress-7.4.5.1-1.2.mga8.x86_64
- libreoffice-kf5-7.4.5.1-1.2.mga8.x86_64
- libreoffice-langpack-en-7.4.5.1-1.2.mga8.x86_64
- libreoffice-math-7.4.5.1-1.2.mga8.x86_64
- libreoffice-ogltrans-7.4.5.1-1.2.mga8.x86_64
- libreoffice-opensymbol-fonts-7.4.5.1-1.2.mga8.noarch
- libreoffice-pdfimport-7.4.5.1-1.2.mga8.x86_64
- libreoffice-pyuno-7.4.5.1-1.2.mga8.x86_64
- libreoffice-ure-7.4.5.1-1.2.mga8.x86_64
- libreoffice-ure-common-7.4.5.1-1.2.mga8.x86_64
- libreoffice-writer-7.4.5.1-1.2.mga8.x86_64
- libreoffice-x11-7.4.5.1-1.2.mga8.x86_64
- libreoffice-xsltfilter-7.4.5.1-1.2.mga8.x86_64

-> IPL'd

Writer/Calc working as expected
Impress works - templates available
Draw is working

Good for me.

CC: (none) => brtians1

Comment 5 PC LX 2023-06-29 20:07:33 CEST
Installed and tested without issues.

Tested on a bunch of files from modern Open/LibreOffice and MS Office formats to older legacy formats. No issues or regressions found.


System: Mageia 8, x86_64, Plasma DE, LXQt DE, AMD Ryzen 5 5600G with Radeon Graphics.



$ uname -a
Linux jupiter 6.1.34-desktop-2.mga8 #1 SMP PREEMPT_DYNAMIC Wed Jun 14 19:14:11 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux
$ rpm -qa | grep '7.4.5.1' | sort
autocorr-pt-7.4.5.1-1.2.mga8
libreoffice-7.4.5.1-1.2.mga8
libreoffice-base-7.4.5.1-1.2.mga8
libreoffice-calc-7.4.5.1-1.2.mga8
libreoffice-core-7.4.5.1-1.2.mga8
libreoffice-data-7.4.5.1-1.2.mga8
libreoffice-draw-7.4.5.1-1.2.mga8
libreoffice-emailmerge-7.4.5.1-1.2.mga8
libreoffice-graphicfilter-7.4.5.1-1.2.mga8
libreoffice-gtk3-7.4.5.1-1.2.mga8
libreoffice-help-pt-7.4.5.1-1.2.mga8
libreoffice-impress-7.4.5.1-1.2.mga8
libreoffice-kf5-7.4.5.1-1.2.mga8
libreoffice-langpack-pt-7.4.5.1-1.2.mga8
libreoffice-math-7.4.5.1-1.2.mga8
libreoffice-ogltrans-7.4.5.1-1.2.mga8
libreoffice-opensymbol-fonts-7.4.5.1-1.2.mga8
libreoffice-pdfimport-7.4.5.1-1.2.mga8
libreoffice-pyuno-7.4.5.1-1.2.mga8
libreoffice-ure-7.4.5.1-1.2.mga8
libreoffice-ure-common-7.4.5.1-1.2.mga8
libreoffice-writer-7.4.5.1-1.2.mga8
Comment 6 Thomas Andrews 2023-06-30 14:19:15 CEST
HP Pavilion 15, mga8-64 Plasma system. No installation issues with the US English version.

While my needs are not extensive I use Calc much more than the other components, so that received the bulk of my testing. I was able to load and edit existing Calc and older Excel documents without any issues. In addition, I did the same with a couple of old Writer and Word documents.

Looks good here.

CC: (none) => andrewsfarm

Comment 7 Thomas Andrews 2023-07-02 15:44:19 CEST
No new issues, so this one gets an OK.

Validating. Advisory in comment 2.

Keywords: (none) => validated_update
Whiteboard: (none) => MGA8-64-OK
CC: (none) => sysadmin-bugs

Dave Hodgins 2023-07-06 23:18:03 CEST

CC: (none) => davidwhodgins
Keywords: (none) => advisory

Comment 8 Mageia Robot 2023-07-07 07:56:43 CEST
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2023-0225.html

Resolution: (none) => FIXED
Status: ASSIGNED => RESOLVED


Note You need to log in before you can comment on or make changes to this bug.