Executive Summary
Summary | |
---|---|
Title | libreoffice security and bug fix update |
Informations | |||
---|---|---|---|
Name | RHSA-2017:0914 | First vendor Publication | 2017-04-12 |
Vendor | RedHat | Last vendor Modification | 2017-04-12 |
Severity (Vendor) | N/A | Revision | 01 |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:M/Au:N/C:P/I:N/A:N) | |||
---|---|---|---|
Cvss Base Score | 4.3 | Attack Range | Network |
Cvss Impact Score | 2.9 | Attack Complexity | Medium |
Cvss Expoit Score | 8.6 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
Problem Description: An update for libreoffice is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Client (v. 7) - noarch, x86_64 Red Hat Enterprise Linux Client Optional (v. 7) - x86_64 Red Hat Enterprise Linux Server Optional (v. 7) - aarch64, noarch, ppc64le, x86_64 Red Hat Enterprise Linux Workstation (v. 7) - noarch, x86_64 Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64 3. Description: LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a drawing program. LibreOffice replaces OpenOffice and provides a similar but enhanced and extended office suite. Security Fix(es): * It was found that LibreOffice disclosed contents of a file specified in an embedded object's preview. An attacker could potentially use this flaw to expose details of a system running LibreOffice as an online service via a crafted document. (CVE-2017-3157) Bug Fix(es): * Previously, an improper resource management caused the LibreOffice Calc spreadsheet application to terminate unexpectedly after closing a dialog window with accessibility support enabled. The resource management has been improved, and the described problem no longer occurs. (BZ#1425536) * Previously, when an incorrect password was entered for a password protected document, the document has been considered as valid and a fallback attempt to open it as plain text has been made. As a consequence, it could appear that the document succesfully loaded, while just the encrypted unreadable content was shown. A fix has been made to terminate import attempts after entering incorrect password, and now nothing is loaded when a wrong password is entered. (BZ#1426348) * Previously, an improper resource management caused the LibreOffice Calc spreadsheet application to terminate unexpectedly during exit, after the Text Import dialog for CSV (Comma-separated Value) files closed, when accessibility support was enabled. The resource management has been improved, and the described problem no longer occurs. (BZ#1425535) 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of LibreOffice applications must be restarted for this update to take effect. 5. Bugs fixed (https://bugzilla.redhat.com/): 1425536 - [fix available] Crash in calc after closing dialog box with a11y enabled 1425844 - CVE-2017-3157 libreoffice: Arbitrary file disclosure in Calc and Writer 1426348 - [fix available] Password Protected (Encrypted) files opening as plain text after cancelling password dialog |
Original Source
Url : https://rhn.redhat.com/errata/RHSA-2017-0914.html |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
100 % | CWE-200 | Information Exposure |
CPE : Common Platform Enumeration
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2017-11-02 | Name : The remote Windows host has an application installed that is affected by mult... File : openoffice_414.nasl - Type : ACT_GATHER_INFO |
2017-10-26 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_27229c67b8ff11e79f79ac9e174be3af.nasl - Type : ACT_GATHER_INFO |
2017-07-13 | Name : The remote Virtuozzo host is missing a security update. File : Virtuozzo_VZLSA-2017-0979.nasl - Type : ACT_GATHER_INFO |
2017-07-13 | Name : The remote Virtuozzo host is missing a security update. File : Virtuozzo_VZLSA-2017-0914.nasl - Type : ACT_GATHER_INFO |
2017-04-24 | Name : The remote Debian host is missing a security update. File : debian_DLA-910.nasl - Type : ACT_GATHER_INFO |
2017-04-20 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20170418_libreoffice_on_SL6_x.nasl - Type : ACT_GATHER_INFO |
2017-04-20 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2017-0979.nasl - Type : ACT_GATHER_INFO |
2017-04-19 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2017-0979.nasl - Type : ACT_GATHER_INFO |
2017-04-18 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2017-0979.nasl - Type : ACT_GATHER_INFO |
2017-04-14 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2017-0914.nasl - Type : ACT_GATHER_INFO |
2017-04-13 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20170412_libreoffice_on_SL7_x.nasl - Type : ACT_GATHER_INFO |
2017-04-13 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2017-0914.nasl - Type : ACT_GATHER_INFO |
2017-04-13 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2017-0914.nasl - Type : ACT_GATHER_INFO |
2017-03-02 | Name : An application installed on the remote host is affected by multiple vulnerabi... File : macos_libreoffice_530.nasl - Type : ACT_GATHER_INFO |
2017-03-02 | Name : An application installed on the remote host is affected by multiple vulnerabi... File : libreoffice_530.nasl - Type : ACT_GATHER_INFO |
2017-02-24 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-3792.nasl - Type : ACT_GATHER_INFO |
2017-02-24 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-3210-1.nasl - Type : ACT_GATHER_INFO |
Alert History
Date | Informations |
---|---|
2018-01-05 09:26:26 |
|
2017-07-14 13:24:51 |
|
2017-04-15 13:24:21 |
|
2017-04-14 13:22:13 |
|
2017-04-13 00:19:14 |
|