CVE-2019-9853

LibreOffice documents can contain macros. The execution of those macros is controlled by the document security settings, typically execution of macros are blocked by default. A URL decoding flaw existed in how the urls to the macros within the document were processed and categorized, resulting in the possibility to construct a document where macro execution bypassed the security settings. The documents were correctly detected as containing macros, and prompted the user to their existence within the documents, but macros within the document were subsequently not controlled by the security settings allowing arbitrary macro execution This issue affects: LibreOffice 6.2 series versions prior to 6.2.7; LibreOffice 6.3 series versions prior to 6.3.1.

Updated libreoffice packages fix security vulnerabilities:

LibreOffice has a feature where documents can specify that pre-installed scripts can be executed on various document events such as mouse-over, etc. LibreOffice is typically also bundled with LibreLogo, a programmable turtle vector graphics script, which can be manipulated into executing arbitrary python commands. By using the document event feature to trigger LibreLogo to execute python contained within a document a malicious document could be constructed which would execute arbitrary python commands silently without warning. In the fixed versions, LibreLogo cannot be called from a document event handler (CVE-2019-9848).

LibreOffice has a 'stealth mode' in which only documents from locations deemed 'trusted' are allowed to retrieve remote resources. This mode is not the default mode, but can be enabled by users who want to disable LibreOffice's ability to include remote resources within a document. A flaw existed where bullet graphics were omitted from this protection (CVE-2019-9849).

LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is launched from. LibreOffice also has a feature where documents can specify that pre-installed scripts can be executed on various document script events such as mouse-over, etc. Protection was added, to address CVE-2019-9848, to block calling LibreLogo from script event handers. However an insufficient url validation vulnerability in LibreOffice allowed malicious to bypass that protection and again trigger calling LibreLogo from script event handlers (CVE-2019-9850).

LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is launched from. Protection was added, to address CVE-2019-9848, to block calling LibreLogo from document event script handers, e.g. mouse over. However LibreOffice also has a separate feature where documents can specify that pre-installed scripts can be executed on various global script events such as document-open, etc. In the fixed versions, global script event handlers are validated equivalently to document script event handlers (CVE-2019-9851).

LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document-open etc. Access is intended to be restricted to scripts under the share/Scripts/python, user/Scripts/python sub-directories of the LibreOffice install. Protection was added, to address CVE-2018-16858, to avoid a directory traversal attack where scripts in arbitrary locations on the file system could be executed. However this new protection could be bypassed by a URL encoding attack. In the fixed versions, the parsed url describing the script location is correctly encoded before further processing (CVE-2019-9852).

LibreOffice documents can contain macros. The execution of those macros is controlled by the document security settings, typically execution of macros are blocked by default. A URL decoding flaw existed in how the urls to the macros within the document were processed and categorized, resulting in the possibility to construct a document where macro execution bypassed the security settings. The documents were correctly detected as containing macros, and prompted the user to their existence within the documents, but macros within the document were subsequently not controlled by the security settings allowing arbitrary macro execution (CVE-2019-9853).

LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document-open etc. Access is intended to be restricted to scripts under the share/Scripts/python, user/Scripts/python sub-directories of the LibreOffice install. Protection was added, to address…

This update libreoffice and libraries fixes the following issues:

LibreOffice was updated to 6.3.3 (jsc#SLE-8705), bringing many bug and stability fixes.

More information for the 6.3 release at: https://wiki.documentfoundation.org/ReleaseNotes/6.3

Security issue fixed:

• CVE-2019-9853: Fixed an issue where by executing macros, the security settings could have been bypassed (bsc#1152684).

Other issues addressed:

• Dropped disable-kde4 switch, since it is no longer known by configure
• Disabled gtk2 because it will be removed in future releases
• librelogo is now a standalone sub-package (bsc#1144522).
• Partial fixes for an issue where Table(s) from DOCX showed wrong position or color (bsc#1061210).

cmis-client was updated to 0.5.2:

• Removed header for Uuid's sha1 header(bsc#1105173).
• Fixed Google Drive login
• Added support for Google Drive two-factor authentication
• Fixed access to SharePoint root folder
• Limited the maximal number of redirections to 20
• Switched library implementation to C++11 (the API remains C++98-compatible)
• Fixed encoding of OAuth2 credentials
• Dropped cppcheck run from 'make check'. A new 'make cppcheck' target was created for it
• Added proper API symbol exporting
• Speeded up building of tests a bit
• Fixed a few issues found by coverity and cppcheck

libixion was updated to 0.15.0:

• Updated for new liborcus
• Switched to spdlog for compile-time debug log outputs
• Fixed various issues

libmwaw was updated 0.3.15:

• Fixed fuzzing issues

liborcus was updated to 0.15.3:

• Fixed various xml related bugs
• Improved performance
• Fixed multiple parser issues
• Added map and structure mode to orcus-json
• Other improvements and fixes

mdds was updated to 1.5.0:

• API changed to 1.5
• Moved the API incompatibility notes from README to the rst doc.
• Added the overview section for flat_segment_tree.

myspell-dictionaries was updated to 20191016:

• Updated Slovenian thesaurus
• Updated the da_DK dictionary
• Removed the abbreviations from Thai hunspell dictionary
• Updated the English dictionaries
• Fixed the logo management for 'ca'

spdlog was updated to 0.16.3:

• Fixed sleep issue under MSVC that happens when changing the clock backwards
• Ensured that macros always expand to expressions
• Added global flush_on function

This update was imported from the SUSE:SLE-15:Update update project.

These are all security issues fixed in the libreoffice-7.1.5.2-3.13 package on the GA media of openSUSE Tumbleweed.

This update libreoffice to version 6.3.3 fixes the following issues:

LibreOffice was updated to 6.3.3 (jsc#SLE-8705), bringing many bug and stability fixes.

More information for the 6.3 release at: https://wiki.documentfoundation.org/ReleaseNotes/6.3

Security issue fixed:

• CVE-2019-9853: Fixed an issue where by executing macros, the security settings could have been bypassed (bsc#1152684).

Other issues addressed:

• Dropped disable-kde4 switch, since it is no longer known by configure
• Disabled gtk2 because it will be removed in future releases
• librelogo is now a standalone sub-package (bsc#1144522).
• Partial fixes for an issue where Table(s) from DOCX showed wrong position or color (bsc#1061210).

This update libreoffice and libraries fixes the following issues:

LibreOffice was updated to 6.3.3 (jsc#SLE-8705), bringing many bug and stability fixes.

More information for the 6.3 release at: https://wiki.documentfoundation.org/ReleaseNotes/6.3

Security issue fixed:

• CVE-2019-9853: Fixed an issue where by executing macros, the security settings could have been bypassed (bsc#1152684).

Other issues addressed:

• Dropped disable-kde4 switch, since it is no longer known by configure
• Disabled gtk2 because it will be removed in future releases
• librelogo is now a standalone sub-package (bsc#1144522).
• Partial fixes for an issue where Table(s) from DOCX showed wrong position or color (bsc#1061210).

cmis-client was updated to 0.5.2:

• Removed header for Uuid's sha1 header(bsc#1105173).
• Fixed Google Drive login
• Added support for Google Drive two-factor authentication
• Fixed access to SharePoint root folder
• Limited the maximal number of redirections to 20
• Switched library implementation to C++11 (the API remains C++98-compatible)
• Fixed encoding of OAuth2 credentials
• Dropped cppcheck run from 'make check'. A new 'make cppcheck' target was created for it
• Added proper API symbol exporting
• Speeded up building of tests a bit
• Fixed a few issues found by coverity and cppcheck

libixion was updated to 0.15.0:

• Updated for new liborcus
• Switched to spdlog for compile-time debug log outputs
• Fixed various issues

libmwaw was updated 0.3.15:

• Fixed fuzzing issues

liborcus was updated to 0.15.3:

• Fixed various xml related bugs
• Improved performance
• Fixed multiple parser issues
• Added map and structure mode to orcus-json
• Other improvements and fixes

mdds was updated to 1.5.0:

• API changed to 1.5
• Moved the API incompatibility notes from README to the rst doc.
• Added the overview section for flat_segment_tree.

myspell-dictionaries was updated to 20191016:

• Updated Slovenian thesaurus
• Updated the da_DK dictionary
• Removed the abbreviations from Thai hunspell dictionary
• Updated the English dictionaries
• Fixed the logo management for 'ca'

spdlog was updated to 0.16.3:

• Fixed sleep issue under MSVC that happens when changing the clock backwards
• Ensured that macros always expand to expressions
• Added global flush_on function

bluez changes:

• lib: Changed bluetooth.h to compile in strict C

gperf was updated to 3.1:

• The generated C code is now in ANSI-C by default.
• Added option --constants-prefix.
• Added declaration %define constants-prefix.