[SECURITY] [DLA 3915-1] libreoffice security update
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- -------------------------------------------------------------------------
Debian LTS Advisory DLA-3915-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Bastien Roucariès
October 12, 2024 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------
Package : libreoffice
Version : 1:7.0.4-4+deb11u11
CVE ID : CVE-2024-7788
Various file formats are based on the zip file format. In cases of
corruption of the underlying zip's central directory,
LibreOffice offers a "repair mode" which will attempt to
recover the zip file structure by scanning for secondary local
file headers in the zip to reconstruct the document.
Prior to this fix, in the case of digitally signed zip files,
an attacker could construct a document which, when repaired,
reported a signature status not valid for the recovered file.
Previously if verification failed the user could choose
to ignore the failure and enable the macros anyway.
Repair document mode has to be inherently tolerant,
so now in fixed versions all signatures are implied to
be invalid in recovery mode.
For Debian 11 bullseye, this problem has been fixed in version
1:7.0.4-4+deb11u11.
We recommend that you upgrade your libreoffice packages.
For the detailed security status of libreoffice please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/libreoffice
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-----BEGIN PGP SIGNATURE-----
iQJFBAEBCgAvFiEEXQGHuUCiRbrXsPVqADoaLapBCF8FAmcKXN4RHHJvdWNhQGRl
Ymlhbi5vcmcACgkQADoaLapBCF+QLA//QX1YOFhChSz2ByXWd14DyN0nu6cb0SHJ
4BQWFljDgpatckmIZ83a4SIL8pgEFSGaQCCzB5OidVO19/FDZ/I+XvanBYy33HF+
ihqFd/jf8PboTlg+pWIXG1TOm16hAuP3UxDFdn+qD0brgULc1kdd3eIGNHmci4rS
/JzXLtYn9F2vVdhleJDlU4ahawvrT376g8Ed3Kpl8y7kDtMbw5AMnqUMquwDJTtK
PTG+M0jjIrBuRX8EYqZ+qz0Gku4JG3rdrfiIfjeR1jLtw45GIC/px5G1FzeHU4sB
Hl9enMyYBGj3k8KPeTJSz1y16f/PN42eNjnUIl+2Tf0SbAylWK81OrJat1tVXC6q
af/jfodNEnWqiRMRbW5nZhNk5qEyKNnkQDaUXNPuHnlxpsn6NOxU9pYDLrtJ3JrL
yuyiNcDEnrxAvOdrrzC5OkctOX6wfPcYHCZsb7/yZ6YPBSZIYNOxrd1ONKfvmCbf
YkYGxE02EFrPZtebDYyN1+BFhmmUsmjRr9RTVOyoxp7attXjgyOYC3jau6mIuQ/V
m5OEAif+8xvNJcCb/FrQcRTY5omDflJjQYzFtS0XyhGbfoD0BDy9bgmz9MZV5Fz+
HDBV6zaPXamRMbtmQKkcVA5g3MI7jqerDTeRiY5jkUsyzw9RgRN7WLmOZ4bmQOiR
otVkB7zrYQE=
=XZME
-----END PGP SIGNATURE-----
Reply to: