UbuntuUpdates.org

Package "libuno-cppu3"

Name: libuno-cppu3

Description:

LibreOffice UNO runtime environment -- CPPU public library
Latest version: 1:6.4.7-0ubuntu0.20.04.15
Release: focal (20.04)
Level: security
Repository: main
Head package: libreoffice
Homepage: http://www.libreoffice.org

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "libuno-cppu3"

32-bit deb package
64-bit deb package
APT INSTALL

Other versions of "libuno-cppu3" in Focal

Repository Area Version
base main 1:6.4.2-0ubuntu3
updates main 1:6.4.7-0ubuntu0.20.04.15
backports main 1:7.4.7-0ubuntu0.22.10.1~bpo20.04.1
PPA: LibreOffice 4:7.6.7-0ubuntu0.20.04.1~lo1

Changelog

Version: 1:6.4.7-0ubuntu0.20.04.15 2025-05-08 16:07:17 UTC

  libreoffice (1:6.4.7-0ubuntu0.20.04.15) focal-security; urgency=medium

  * SECURITY UPDATE: PDF signature forgery with adbe.pkcs7.sha1 SubFilter
    - debian/patches/CVE-2025-2866.patch: Improve adbe.pkcs7.sha1 signature
      verification
    - CVE-2025-2866

 -- Rico Tzschichholz <email address hidden> Mon, 05 May 2025 17:20:55 +0200
Source diff to previous version
CVE-2025-2866 Improper Verification of Cryptographic Signature vulnerability in LibreOffice allows PDF Signature Spoofing by Improper Validation. In the affect

Version: 1:6.4.7-0ubuntu0.20.04.14 2025-03-10 15:06:55 UTC

  libreoffice (1:6.4.7-0ubuntu0.20.04.14) focal-security; urgency=medium

  * SECURITY UPDATE: Macro URL arbitrary script execution
    - debian/patches/CVE-2025-1080.patch: Filter out more unwanted command
      URIs
    - CVE-2025-1080

 -- Rico Tzschichholz <email address hidden> Thu, 06 Mar 2025 08:58:09 +0100
Source diff to previous version
CVE-2025-1080 LibreOffice supports Office URI Schemes to enable browser integration of LibreOffice with MS SharePoint server. An additional scheme 'vnd.libreoffice

Version: 1:6.4.7-0ubuntu0.20.04.13 2025-01-27 16:07:05 UTC

  libreoffice (1:6.4.7-0ubuntu0.20.04.13) focal-security; urgency=medium

  * SECURITY UPDATE: Path traversal leading to arbitrary .ttf file write
    - debian/patches/CVE-2024-12425.patch: be conservative on allowed temp
      font names
    - CVE-2024-12425
  * SECURITY UPDATE: URL fetching can be used to exfiltrate arbitrary INI
      file values and environment variables
    - debian/patches/CVE-2024-12426-1.patch: consider VndSunStarExpand an
      exotic protocol
    - debian/patches/CVE-2024-12426-2.patch: look at 'embedded' protocols too
    - CVE-2024-12426
    - debian/patches/CVE-2024-12426-3.patch: Fix check for further exotic
      protocols

 -- Rico Tzschichholz <email address hidden> Thu, 23 Jan 2025 14:54:13 +0100
Source diff to previous version
CVE-2024-12425 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The Document Foundation LibreOffice allows Absolute P
CVE-2024-12426 Exposure of Environmental Variables and arbitrary INI file values to an Unauthorized Actor vulnerability in The Document Foundation LibreOffice.

Version: 1:6.4.7-0ubuntu0.20.04.12 2024-09-19 16:06:59 UTC

  libreoffice (1:6.4.7-0ubuntu0.20.04.12) focal-security; urgency=medium

  * SECURITY UPDATE: Signatures in "repair mode" should not be trusted
    - debian/patches/CVE-2024-7788.patch: sfx2: SfxObjectShell should
      not trust any signature on repaired package
    - CVE-2024-7788

 -- Rico Tzschichholz <email address hidden> Wed, 18 Sep 2024 17:10:51 +0200
Source diff to previous version
CVE-2024-7788 Improper Digital Signature Invalidation  vulnerability in Zip Repair Mode of The Document Foundation LibreOffice allows Signature forgery vulnerabili

Version: 1:6.4.7-0ubuntu0.20.04.11 2024-08-15 14:07:12 UTC

  libreoffice (1:6.4.7-0ubuntu0.20.04.11) focal-security; urgency=medium

  * SECURITY UPDATE: Ability to trust not validated macro signatures
    removed in high security mode (LP: #2076130)
    - debian/patches/CVE-2024-6472.patch: remove ability to trust not
      validated macro signatures in high security
    - CVE-2024-6472

 -- Rico Tzschichholz <email address hidden> Mon, 05 Aug 2024 21:28:04 +0200
2076130 CVE-2024-6472
CVE-2024-6472 Certificate Validation user interface in LibreOffice allows potential vulnerability. Signed macros are scripts that have been digitally signed by


About   -   Send Feedback to @ubuntu_updates