DSA-5252: -1 libreoffice -- security update

Published Oct 12, 2022

Updated

It was discovered that insufficient validation of vnd.libreoffice.command URI schemes could result in the execution of arbitrary macro commands.

Affected Software

2 affected components

debian/libreoffice

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade libreoffice to a version that resolves this vulnerability.
Patch DSA-5252-1

Event History

Oct 12, 2022

Advisory Published

12:00 AM

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2022-3140

Frequently Asked Questions

What must an attacker do to exploit this issue?

An attacker needs to cause LibreOffice to process a vnd.libreoffice.command URI scheme containing a malicious macro command. Insufficient validation can then allow execution of that macro command.

How can I determine whether a system may be affected?

Check whether LibreOffice from Debian is installed and whether the installed package includes the security update referenced by DSA-5252. The supplied information does not identify affected or fixed package versions.