CVE-2023-2255

Improper access control in editor components of The Document Foundation LibreOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt. In the affected versions of LibreOffice documents that used "floating frames" linked to external files, would load the contents of those frames without prompting the user for permission to do so. This was inconsistent with the treatment of other linked content in LibreOffice. This issue affects: The Document Foundation LibreOffice 7.4 versions prior to 7.4.7; 7.5 versions prior to 7.5.3.

LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a drawing program. LibreOffice replaces OpenOffice and provides a similar but enhanced and extended office suite.

Security Fix(es):

• libreoffice: Empty entry in Java class path (CVE-2022-38745)
• libreoffice: Array index underflow in Calc formula parsing (CVE-2023-0950)
• libreoffice: Arbitrary file write (CVE-2023-1183)
• libreoffice: Remote documents loaded without prompt via IFrame (CVE-2023-2255)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a drawing program. LibreOffice replaces OpenOffice and provides a similar but enhanced and extended office suite.

Security Fix(es):

• libreoffice: Empty entry in Java class path (CVE-2022-38745)
• libreoffice: Array index underflow in Calc formula parsing (CVE-2023-0950)
• libreoffice: Arbitrary file write (CVE-2023-1183)
• libreoffice: Remote documents loaded without prompt via IFrame (CVE-2023-2255)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Improper Validation of Array Index vulnerability in the spreadsheet component of The Document Foundation LibreOffice allows an attacker to craft a spreadsheet document that will cause an array index underflow when loaded. In the affected versions of LibreOffice certain malformed spreadsheet formulas, such as AGGREGATE, could be created with less parameters passed to the formula interpreter than it expected, leading to an array index underflow, in which case there is a risk that arbitrary code could be executed. (CVE-2023-0950)

Improper access control in editor components of The Document Foundation LibreOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt. In the affected versions of LibreOffice documents that used "floating frames" linked to external files, would load the contents of those frames without prompting the user for permission to do so. This was inconsistent with the treatment of other linked content in LibreOffice. (CVE-2023-2255)

This update for LibreOffice and xmlsec1 fixes the following issue:

libreoffice:

• Version update from 7.4.3.2 to 7.5.4.1 (jsc#PED-3561, jsc#PED-3550, jsc#3549):
  • For the highlights of changes of version 7.5 please consult the official release notes: https://wiki.documentfoundation.org/ReleaseNotes/7.5
  • Security issues fixed:
    • CVE-2023-0950: Fixed stack underflow in ScInterpreter (bsc#1209242)
    • CVE-2023-2255: Fixed vulnerability where remote documents could be loaded without prompt via IFrame (bsc#1211746)
  • Bug fixes:
    • Fix PPTX shadow effect for table offset (bsc#1204040)
    • Fix ability to set the default tab size for each text object (bsc#1198666)
    • Fix PPTX extra vertical space between different text formats (bsc#1200085)
    • Do not use binutils-gold as the package is unmaintained and will be removed in the future (boo#1210687)
  • Updated bundled dependencies:
    • boost version update from 1_77_0 to 1_80_0
    • curl version update from 7.83.1 to 8.0.1
    • gpgme version update from 1.16.0 to 1.18.0
    • icu4c-data version update from 70_1 to 72_1
    • icu4c version update from 70_1 to 72_1
    • pdfium version update from 4699 to 5408
    • poppler version update from 21.11.0 to 22.12.0

xmlsec1:

• Version update from 1.2.28 to 1.2.37 required by LibreOffice 7.5.2.2 (jsc#PED-3561, jsc#PED-3550):
  • Retired the XMLSec mailing list '[email protected]' and the XMLSec Online Signature Verifier.
  • Migration to OpenSSL 3.0 API Note that OpenSSL engines are disabled by default when XMLSec library is compiled against OpenSSL 3.0. To re-enable OpenSSL engines, use --enable-openssl3-engines configure flag (there will be a lot of deprecation warnings).
  • The OpenSSL before 1.1.0 and LibreSSL before 2.7.0 are now deprecated and will be removed in the future versions of XMLSec Library.
  • Refactored all the integer casts to ensure cast-safety. Fixed all warnings and enabled -Werror and -pedantic flags on CI builds.
  • Added configure flag to use size_t for xmlSecSize (currently disabled by default for backward compatibility).
  • Support for OpenSSL compiled with OPENSSL_NO_ERR.
  • Full support for LibreSSL 3.5.0 and above
  • Several other small fixes
  • Fix decrypting session key for two recipients
  • Added --privkey-openssl-engine option to enhance openssl engine support
  • Remove MD5 for NSS 3.59 and above
  • Fix PKCS12_parse return code handling
  • Fix OpenSSL lookup
  • xmlSecX509DataGetNodeContent(): don't return 0 for non-empty elements - fix for LibreOffice
  • Unload error strings in OpenSSL shutdown.
  • Make userData available when executing preExecCallback function
  • Add an option to use secure memset.
  • Enabled XML_PARSE_HUGE for all xml parsers.
  • Various build and tests fixes and improvements.
  • Move remaining private header files away from xmlsec/include/`` folder
• Other packaging changes:
  • Relax the crypto policies for the test-suite. It allows the tests using certificates with small key lengths to pass.
  • Pass --disable-md5 to configure: The cryptographic strength of the MD5 algorithm is sufficiently doubtful that its use is discouraged at this time. It is not listed as an algorithm in [XMLDSIG-CORE1] https://www.w3.org/TR/xmlsec-algorithms/#bib-XMLDSIG-CORE1

This update for LibreOffice fixes the following issues:

libreoffice:

• Version update from 7.3.6.2 to 7.5.4.1 (jsc#PED-3561, jsc#PED-3550, jsc#PED-1785):
  • For the highlights of changes of version 7.5 please consult the official release notes: https://wiki.documentfoundation.org/ReleaseNotes/7.5
  • For the highlights of changes of version 7.4 please consult the official release notes: https://wiki.documentfoundation.org/ReleaseNotes/7.4
  • Security issues fixed:
    • CVE-2023-0950: Fixed stack underflow in ScInterpreter (bsc#1209242)
    • CVE-2023-2255: Fixed vulnerability where remote documents could be loaded without prompt via IFrame (bsc#1211746)
  • Bug fixes:
    • Fix PPTX shadow effect for table offset (bsc#1204040)
    • Fix ability to set the default tab size for each text object (bsc#1198666)
    • Fix PPTX extra vertical space between different text formats (bsc#1200085)
    • Do not use binutils-gold as the package is unmaintainedd and will be removed in the future (bsc#1210687)
  • Updated bundled dependencies:
    • boost version update from 1_77_0 to 1_80_0
    • curl version update from 7.83.1 to 8.0.1
    • icu4c-data version update from 70_1 to 72_1
    • icu4c version update from 70_1 to 72_1
    • pdfium version update from 4699 to 5408
    • poppler version update from 21.11.0 to 22.12.0
    • poppler-data version update from 0.4.10 to 0.4.11
    • skia version from m97-a7230803d64ae9d44f4e128244480111a3ae967 to m103-b301ff025004c9cd82816c86c547588e6c24b466
  • New build dependencies:
    • fixmath-devel
    • libwebp-devel
    • zlib-devel
    • dragonbox-devel
    • at-spi2-core-devel
    • libtiff-devel

dragonbox:

• New package at version 1.1.3 (jsc#PED-1785)
  • New dependency for LibreOffice 7.4

fixmath:

• New package at version 2022.07.20 (jsc#PED-1785)
  • New dependency for LibreOffice 7.4

libmwaw:

• Version update from 0.3.20 to 0.3.21 (jsc#PED-1785):
  • Add debug code to read some private rsrc data
  • Allow to read some MacWrite which does not have printer informations
  • Add a parser for Scoop files
  • Add a parser for ScriptWriter files
  • Add a parser for ReadySetGo 1-4 files

xmlsec1:

• Version update from 1.2.28 to 1.2.37 required by LibreOffice 7.5.2.2 (jsc#PED-3561, jsc#PED-3550):
  • Retired the XMLSec mailing list '[email protected]' and the XMLSec Online Signature Verifier.
  • Migration to OpenSSL 3.0 API Note that OpenSSL engines are disabled by default when XMLSec library is compiled against OpenSSL 3.0. To re-enable OpenSSL engines, use --enable-openssl3-engines configure flag (there will be a lot of deprecation warnings).
  • The OpenSSL before 1.1.0 and LibreSSL before 2.7.0 are now deprecated and will be removed in the future versions of XMLSec Library.
  • Refactored all the integer casts to ensure cast-safety. Fixed all warnings and enabled -Werror and -pedantic flags on CI builds.
  • Added configure flag to use size_t for xmlSecSize (currently disabled by default for backward compatibility).
  • Support for OpenSSL compiled with OPENSSL_NO_ERR.
  • Full support for LibreSSL 3.5.0 and above
  • Several other small fixes
  • Fix decrypting session key for two recipients
  • Added --privkey-openssl-engine option to enhance openssl engine support
  • Remove MD5 for NSS 3.59 and above
  • Fix PKCS12_parse return code handling
  • Fix OpenSSL lookup
  • xmlSecX509DataGetNodeContent(): don't return 0 for non-empty elements - fix for LibreOffice
  • Unload error strings in OpenSSL shutdown.
  • Make userData available when executing preExecCallback function
  • Add an option to use secure memset.
  • Enabled XML_PARSE_HUGE for all xml parsers.
  • Various build and tests fixes and improvements.
  • Move remaining private header files away from xmlsec/include/`` folder
• Other packaging changes:
  • Relax the crypto policies for the test-suite. It allows the tests using certificates with small key…

This update for LibreOffice fixes the following issues:

libreoffice:

• Version update from 7.3.6.2 to 7.5.4.1 (jsc#PED-3561, jsc#PED-3550, jsc#PED-1785):
  • For the highlights of changes of version 7.5 please consult the official release notes: https://wiki.documentfoundation.org/ReleaseNotes/7.5
  • For the highlights of changes of version 7.4 please consult the official release notes: https://wiki.documentfoundation.org/ReleaseNotes/7.4
  • Security issues fixed:
    • CVE-2023-0950: Fixed stack underflow in ScInterpreter (bsc#1209242)
    • CVE-2023-2255: Fixed vulnerability where remote documents could be loaded without prompt via IFrame (bsc#1211746)
  • Bug fixes:
    • Fix PPTX shadow effect for table offset (bsc#1204040)
    • Fix ability to set the default tab size for each text object (bsc#1198666)
    • Fix PPTX extra vertical space between different text formats (bsc#1200085)
    • Do not use binutils-gold as the package is unmaintainedd and will be removed in the future (bsc#1210687)
  • Updated bundled dependencies:
    • boost version update from 1_77_0 to 1_80_0
    • curl version update from 7.83.1 to 8.0.1
    • icu4c-data version update from 70_1 to 72_1
    • icu4c version update from 70_1 to 72_1
    • pdfium version update from 4699 to 5408
    • poppler version update from 21.11.0 to 22.12.0
    • poppler-data version update from 0.4.10 to 0.4.11
    • skia version from m97-a7230803d64ae9d44f4e128244480111a3ae967 to m103-b301ff025004c9cd82816c86c547588e6c24b466
  • New build dependencies:
    • fixmath-devel
    • libwebp-devel
    • zlib-devel
    • dragonbox-devel
    • at-spi2-core-devel
    • libtiff-devel

dragonbox:

• New package at version 1.1.3 (jsc#PED-1785)
  • New dependency for LibreOffice 7.4

fixmath:

• New package at version 2022.07.20 (jsc#PED-1785)
  • New dependency for LibreOffice 7.4

libmwaw:

• Version update from 0.3.20 to 0.3.21 (jsc#PED-1785):
  • Add debug code to read some private rsrc data
  • Allow to read some MacWrite which does not have printer informations
  • Add a parser for Scoop files
  • Add a parser for ScriptWriter files
  • Add a parser for ReadySetGo 1-4 files

xmlsec1:

• Version update from 1.2.28 to 1.2.37 required by LibreOffice 7.5.2.2 (jsc#PED-3561, jsc#PED-3550):
  • Retired the XMLSec mailing list '[email protected]' and the XMLSec Online Signature Verifier.
  • Migration to OpenSSL 3.0 API Note that OpenSSL engines are disabled by default when XMLSec library is compiled against OpenSSL 3.0. To re-enable OpenSSL engines, use --enable-openssl3-engines configure flag (there will be a lot of deprecation warnings).
  • The OpenSSL before 1.1.0 and LibreSSL before 2.7.0 are now deprecated and will be removed in the future versions of XMLSec Library.
  • Refactored all the integer casts to ensure cast-safety. Fixed all warnings and enabled -Werror and -pedantic flags on CI builds.
  • Added configure flag to use size_t for xmlSecSize (currently disabled by default for backward compatibility).
  • Support for OpenSSL compiled with OPENSSL_NO_ERR.
  • Full support for LibreSSL 3.5.0 and above
  • Several other small fixes
  • Fix decrypting session key for two recipients
  • Added --privkey-openssl-engine option to enhance openssl engine support
  • Remove MD5 for NSS 3.59 and above
  • Fix PKCS12_parse return code handling
  • Fix OpenSSL lookup
  • xmlSecX509DataGetNodeContent(): don't return 0 for non-empty elements - fix for LibreOffice
  • Unload error strings in OpenSSL shutdown.
  • Make userData available when executing preExecCallback function
  • Add an option to use secure memset.
  • Enabled XML_PARSE_HUGE for all xml parsers.
  • Various build and tests fixes and improvements.
  • Move remaining private header files away from xmlsec/include/`` folder
• Other packaging changes:
  • Relax the crypto policies for the test-suite. It allows the tests using certificates with small key…

It was discovered that LibreOffice did not properly validate the number of parameters passed to the formula interpreter, leading to an array index underflow attack. If a user were tricked into opening a specially crafted spreadsheet file, an attacker could possibly use this issue to execute arbitrary code. (CVE-2023-0950)

Amel Bouziane-Leblond discovered that LibreOffice did not prompt the user before loading the host document inside an IFrame. If a user were tricked into opening a specially crafted input file, an attacker could possibly use this issue to cause information disclosure or execute arbitrary code. (CVE-2023-2255)