Executive Summary

Summary
Title libreoffice security and bug fix update
Informations
Name RHSA-2017:0914 First vendor Publication 2017-04-12
Vendor RedHat Last vendor Modification 2017-04-12
Severity (Vendor) N/A Revision 01

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:P/I:N/A:N)
Cvss Base Score 4.3 Attack Range Network
Cvss Impact Score 2.9 Attack Complexity Medium
Cvss Expoit Score 8.6 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Problem Description:

An update for libreoffice is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Client (v. 7) - noarch, x86_64 Red Hat Enterprise Linux Client Optional (v. 7) - x86_64 Red Hat Enterprise Linux Server Optional (v. 7) - aarch64, noarch, ppc64le, x86_64 Red Hat Enterprise Linux Workstation (v. 7) - noarch, x86_64 Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64

3. Description:

LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a drawing program. LibreOffice replaces OpenOffice and provides a similar but enhanced and extended office suite.

Security Fix(es):

* It was found that LibreOffice disclosed contents of a file specified in an embedded object's preview. An attacker could potentially use this flaw to expose details of a system running LibreOffice as an online service via a crafted document. (CVE-2017-3157)

Bug Fix(es):

* Previously, an improper resource management caused the LibreOffice Calc spreadsheet application to terminate unexpectedly after closing a dialog window with accessibility support enabled. The resource management has been improved, and the described problem no longer occurs. (BZ#1425536)

* Previously, when an incorrect password was entered for a password protected document, the document has been considered as valid and a fallback attempt to open it as plain text has been made. As a consequence, it could appear that the document succesfully loaded, while just the encrypted unreadable content was shown. A fix has been made to terminate import attempts after entering incorrect password, and now nothing is loaded when a wrong password is entered. (BZ#1426348)

* Previously, an improper resource management caused the LibreOffice Calc spreadsheet application to terminate unexpectedly during exit, after the Text Import dialog for CSV (Comma-separated Value) files closed, when accessibility support was enabled. The resource management has been improved, and the described problem no longer occurs. (BZ#1425535)

4. Solution:

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of LibreOffice applications must be restarted for this update to take effect.

5. Bugs fixed (https://bugzilla.redhat.com/):

1425536 - [fix available] Crash in calc after closing dialog box with a11y enabled 1425844 - CVE-2017-3157 libreoffice: Arbitrary file disclosure in Calc and Writer 1426348 - [fix available] Password Protected (Encrypted) files opening as plain text after cancelling password dialog

Original Source

Url : https://rhn.redhat.com/errata/RHSA-2017-0914.html

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-200 Information Exposure

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 15
Os 2
Os 2
Os 2
Os 3
Os 4
Os 2
Os 2

Nessus® Vulnerability Scanner

Date Description
2017-11-02 Name : The remote Windows host has an application installed that is affected by mult...
File : openoffice_414.nasl - Type : ACT_GATHER_INFO
2017-10-26 Name : The remote FreeBSD host is missing one or more security-related updates.
File : freebsd_pkg_27229c67b8ff11e79f79ac9e174be3af.nasl - Type : ACT_GATHER_INFO
2017-07-13 Name : The remote Virtuozzo host is missing a security update.
File : Virtuozzo_VZLSA-2017-0979.nasl - Type : ACT_GATHER_INFO
2017-07-13 Name : The remote Virtuozzo host is missing a security update.
File : Virtuozzo_VZLSA-2017-0914.nasl - Type : ACT_GATHER_INFO
2017-04-24 Name : The remote Debian host is missing a security update.
File : debian_DLA-910.nasl - Type : ACT_GATHER_INFO
2017-04-20 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20170418_libreoffice_on_SL6_x.nasl - Type : ACT_GATHER_INFO
2017-04-20 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2017-0979.nasl - Type : ACT_GATHER_INFO
2017-04-19 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2017-0979.nasl - Type : ACT_GATHER_INFO
2017-04-18 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2017-0979.nasl - Type : ACT_GATHER_INFO
2017-04-14 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2017-0914.nasl - Type : ACT_GATHER_INFO
2017-04-13 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20170412_libreoffice_on_SL7_x.nasl - Type : ACT_GATHER_INFO
2017-04-13 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2017-0914.nasl - Type : ACT_GATHER_INFO
2017-04-13 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2017-0914.nasl - Type : ACT_GATHER_INFO
2017-03-02 Name : An application installed on the remote host is affected by multiple vulnerabi...
File : macos_libreoffice_530.nasl - Type : ACT_GATHER_INFO
2017-03-02 Name : An application installed on the remote host is affected by multiple vulnerabi...
File : libreoffice_530.nasl - Type : ACT_GATHER_INFO
2017-02-24 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-3792.nasl - Type : ACT_GATHER_INFO
2017-02-24 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-3210-1.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
Date Informations
2018-01-05 09:26:26
  • Multiple Updates
2017-07-14 13:24:51
  • Multiple Updates
2017-04-15 13:24:21
  • Multiple Updates
2017-04-14 13:22:13
  • Multiple Updates
2017-04-13 00:19:14
  • First insertion