Package: libreoffice-calc Version: 1:6.1.5-3+deb10u6 Severity: grave Tags: security Justification: user security hole
Dear Maintainer, When opening any CSV file with LibreOffice Calc, Calc opens and executes encodings.py from the current working directory. That presumably happens because Some file managers, including Krusader and mc, would launch localc in the current directory, as would running it from the command line (such as `localc file.csv'), thereby running encodings.py from the directory containing the file. The issue is not present when LibreOffice is launched through the application launcher, and the file is opened later through whatever means (neither Open file, nor through a file manager or the command line, since localc already operates in one's $HOME in that instance) To reproduce the issue, one needs to: 1. Close LibreOffice *completely* 2. In an empty directory, create "encodings.py" which raises an exception 3. In the same directory (for simplicity), create "file.csv" with some rows. 4. Open "file.csv" with `localc ./file.csv' using the directory containing "encodings.py" (double clicking in krusader and mc leads to the same result) The result is that LibreOffice crashes with the Python exception raised by the rogue encodings.py, and then exits with an error that reads: Fatal Python error: initfsencoding: Unable to get the locale encoding An offer is made to recover the unsaved file (but the list is empty), relaunching LO sometimes leads to new crashes. This is NOT the only way the issue happens, I was able to get the same crash while clicking through the menus or editing an .ods which initially didn't cause a crash, but those aren't deterministically reproduced, whereas the .csv route seems to guarantee a crash for me even when the .csv is ASCII. The problem is present in both Debian Stable (1:6.1.5-3+deb10u6), and Buster Backports (1:7.0.4~rc2-1~bpo10+2). No extensions not installed by apt are present on either machine (on the one with 6.1.5 I never installed any, and on the 7.0.4 I'm trusting what the LO extension manager is telling me, since I cannot recall for sure) Here's the console chatter: # Test on the host with 1:7.0.4~rc2-1~bpo10+2 - hostname is censored milko@host2 ~/Временна/LOSecurity $ cat > encodings.py raise NotImplementedError("Darth Vader, Obi-Wan and Ahsoka walk into a bar") milko@host2 ~/Временна/LOSecurity $ cat > test.csv Column 1;Column 2;Column 3 текст;ຂໍ້ຄວາມ;text milko@host2 ~/Временна/LOSecurity $ localc test.csv Fatal Python error: initfsencoding: Unable to get the locale encoding Traceback (most recent call last): File "/home/milko/Временна/LOSecurity/encodings.py", line 1, in <module> NotImplementedError: Darth Vader, Obi-Wan and Ahsoka walk into a bar Fatal Python error: initfsencoding: Unable to get the locale encoding Traceback (most recent call last): File "/home/milko/Временна/LOSecurity/encodings.py", line 1, in <module> NotImplementedError: Darth Vader, Obi-Wan and Ahsoka walk into a bar milko@host2 ~/Временна/LOSecurity $ cat > test2.csv Column 1;Column 2;Column 3 text1;text2;text3 milko@host2 ~/Временна/LOSecurity $ localc test2.csv Fatal Python error: initfsencoding: Unable to get the locale encoding Traceback (most recent call last): File "/home/milko/Временна/LOSecurity/encodings.py", line 1, in <module> NotImplementedError: Darth Vader, Obi-Wan and Ahsoka walk into a bar Application Error milko@host2 ~/Временна/LOSecurity $ # Test on the host with 1:6.1.5-3+deb10u6 - hostname is censored # The encodings.py and test.csv were copied from host2 milko@host1 ~/Временни/LOSecurity $ localc test2.csv Fatal Python error: initfsencoding: Unable to get the locale encoding Traceback (most recent call last): File "/home/milko/Временни/LOSecurity/encodings.py", line 1, in <module> NotImplementedError: Darth Vader, Obi-Wan and Ahsoka walk into a bar milko@host1 ~/Временни/LOSecurity $ lowriter Fatal Python error: initfsencoding: Unable to get the locale encoding Traceback (most recent call last): File "/home/milko/Временни/LOSecurity/encodings.py", line 1, in <module> NotImplementedError: Darth Vader, Obi-Wan and Ahsoka walk into a bar ^C milko@host1 ~/Временни/LOSecurity $ LO packages installed on host1 and host2. I do apologize for the untidy mess with transitional and unpurged packages and leftover from the dawn of time (especially on host2) -- I didn't expect someone to be looking through my messy house -- but I have to leave them here in case one of them comes responsible. milko@host2 ~ $ dpkg -l | grep -i -e libreoffice -e 1:7.0.4~rc2-1~bpo10+2 ii hyphen-ru 20030310-1 all Russian hyphenation patterns for LibreOffice/OpenOffice.org ii jabref-plugin-oo 2.10+ds-3 all LibreOffice plugin for JabRef (transitional dummy package) ii libjuh-java 1:7.0.4~rc2-1~bpo10+2 all LibreOffice UNO runtime environment -- Java Uno helper (compatibility library) ii libjurt-java 1:7.0.4~rc2-1~bpo10+2 all LibreOffice UNO runtime environment -- Java Uno Runtime (compatibility library) ii liblibreoffice-java 1:7.0.4~rc2-1~bpo10+2 all LibreOffice UNO runtime environment -- Java library ii libreoffice 1:7.0.4~rc2-1~bpo10+2 amd64 office productivity suite (metapackage) ii libreoffice-avmedia-backend-gstreamer 1:7.0.4~rc2-1~bpo10+2 amd64 transitional package for GStreamer backend for LibreOffice ii libreoffice-base 1:7.0.4~rc2-1~bpo10+2 amd64 office productivity suite -- database ii libreoffice-base-core 1:7.0.4~rc2-1~bpo10+2 amd64 office productivity suite -- shared library ii libreoffice-base-drivers 1:7.0.4~rc2-1~bpo10+2 amd64 Database connectivity drivers for LibreOffice ii libreoffice-calc 1:7.0.4~rc2-1~bpo10+2 amd64 office productivity suite -- spreadsheet ii libreoffice-common 1:7.0.4~rc2-1~bpo10+2 all office productivity suite -- arch-independent files ii libreoffice-core 1:7.0.4~rc2-1~bpo10+2 amd64 office productivity suite -- arch-dependent files ii libreoffice-draw 1:7.0.4~rc2-1~bpo10+2 amd64 office productivity suite -- drawing rc libreoffice-filter-binfilter 1:3.5.4+dfsg2-0+deb7u2 amd64 office productivity suite -- legacy filters (e.g. StarOffice 5.2) ii libreoffice-gnome 1:7.0.4~rc2-1~bpo10+2 amd64 office productivity suite -- GNOME integration rc libreoffice-gtk 1:5.2.7-1+deb9u10 all transitional package to upgrade to libreoffice-gtk2/-systray ii libreoffice-gtk3 1:7.0.4~rc2-1~bpo10+2 amd64 office productivity suite -- GTK+ 3 integration ii libreoffice-help-common 1:7.0.4~rc2-1~bpo10+2 all office productivity suite -- common files for LibreOffice help ii libreoffice-help-en-us 1:7.0.4~rc2-1~bpo10+2 all office productivity suite -- English_american help ii libreoffice-impress 1:7.0.4~rc2-1~bpo10+2 amd64 office productivity suite -- presentation ii libreoffice-java-common 1:7.0.4~rc2-1~bpo10+2 all office productivity suite -- arch-independent Java support files ii libreoffice-kde5 1:7.0.4~rc2-1~bpo10+2 amd64 transitional package for LibreOffice "KDE 5" integration ii libreoffice-kf5 1:7.0.4~rc2-1~bpo10+2 amd64 office productivity suite -- KDE Frameworks 5 integration ii libreoffice-l10n-bg 1:7.0.4~rc2-1~bpo10+2 all office productivity suite -- Bulgarian language package ii libreoffice-librelogo 1:7.0.4~rc2-1~bpo10+2 all Logo-like programming language for LibreOffice ii libreoffice-lightproof-en 0.4.3+1.5+git20140515-2 all Lightproof grammar checker for LibreOffice (English) ii libreoffice-math 1:7.0.4~rc2-1~bpo10+2 amd64 office productivity suite -- equation editor ii libreoffice-mysql-connector 1:7.0.4~rc2-1~bpo10+2 amd64 transitional package for MariaDB/MySQL Connector extension for LibreOffice ii libreoffice-nlpsolver 0.9+LibO6.1.5-3+deb10u6 all "Solver for Nonlinear Programming" extension for LibreOffice ii libreoffice-plasma 1:7.0.4~rc2-1~bpo10+2 amd64 office productivity suite -- some Plasma integration ii libreoffice-presentation-minimizer 1:4.3.3-2+deb8u12 all transitional package for the LibreOffice presentation minimizer ii libreoffice-presenter-console 1:4.3.3-2+deb8u12 all transitional package for the LibreOffice presenter console ii libreoffice-qt5 1:7.0.4~rc2-1~bpo10+2 amd64 office productivity suite -- Qt 5 integration ii libreoffice-report-builder 1:7.0.4~rc2-1~bpo10+2 all LibreOffice component for building database reports ii libreoffice-report-builder-bin 1:7.0.4~rc2-1~bpo10+2 amd64 LibreOffice component for building database reports -- libraries ii libreoffice-script-provider-bsh 1:7.0.4~rc2-1~bpo10+2 all BeanShell script support provider for LibreOffice scripting framework ii libreoffice-script-provider-js 1:7.0.4~rc2-1~bpo10+2 all JavaScript script support provider for LibreOffice scripting framework ii libreoffice-script-provider-python 1:7.0.4~rc2-1~bpo10+2 all Python script support provider for LibreOffice scripting framework ii libreoffice-sdbc-firebird 1:7.0.4~rc2-1~bpo10+2 amd64 Firebird SDBC driver for LibreOffice ii libreoffice-sdbc-hsqldb 1:7.0.4~rc2-1~bpo10+2 amd64 HSQLDB SDBC driver for LibreOffice ii libreoffice-sdbc-mysql 1:7.0.4~rc2-1~bpo10+2 amd64 MariaDB/MySQL SDBC driver for LibreOffice ii libreoffice-sdbc-postgresql 1:7.0.4~rc2-1~bpo10+2 amd64 PostgreSQL SDBC driver for LibreOffice ii libreoffice-style-breeze 1:7.0.4~rc2-1~bpo10+2 all office productivity suite -- Breeze symbol style ii libreoffice-style-colibre 1:7.0.4~rc2-1~bpo10+2 all office productivity suite -- colibre symbol style ii libreoffice-style-elementary 1:7.0.4~rc2-1~bpo10+2 all office productivity suite -- Elementary symbol style rc libreoffice-style-galaxy 1:5.2.7-1+deb9u10 all office productivity suite -- Galaxy (Default) symbol style rc libreoffice-style-hicontrast 1:5.2.7-1+deb9u10 all office productivity suite -- Hicontrast symbol style ii libreoffice-style-karasa-jaga 1:7.0.4~rc2-1~bpo10+2 all office productivity suite -- Karasa Jaga symbol style rc libreoffice-style-oxygen 1:5.2.7-1+deb9u10 all office productivity suite -- Oxygen symbol style ii libreoffice-style-sifr 1:7.0.4~rc2-1~bpo10+2 all office productivity suite -- Sifr symbol style ii libreoffice-style-sukapura 1:7.0.4~rc2-1~bpo10+2 all office productivity suite -- Sukapura symbol style ii libreoffice-wiki-publisher 1.2.0+LibO6.1.5-3+deb10u6 all LibreOffice extension for working with MediaWiki articles ii libreoffice-writer 1:7.0.4~rc2-1~bpo10+2 amd64 office productivity suite -- word processor ii libreoffice-writer2latex 1.4-8 all Writer/Calc to LaTeX converter extension for LibreOffice ii libreoffice-writer2xhtml 1.4-8 all Writer/Calc to XHTML converter extension for LibreOffice ii libridl-java 1:7.0.4~rc2-1~bpo10+2 all LibreOffice UNO runtime environment -- Java Uno runtime and base types and types access library (compatibility library) ii libuno-cppu3 1:7.0.4~rc2-1~bpo10+2 amd64 LibreOffice UNO runtime environment -- CPPU public library ii libuno-cppuhelpergcc3-3 1:7.0.4~rc2-1~bpo10+2 amd64 LibreOffice UNO runtime environment -- CPPU helper library ii libuno-purpenvhelpergcc3-3 1:7.0.4~rc2-1~bpo10+2 amd64 LibreOffice UNO runtime environment -- "purpose environment" helper ii libuno-sal3 1:7.0.4~rc2-1~bpo10+2 amd64 LibreOffice UNO runtime environment -- SAL public library ii libuno-salhelpergcc3-3 1:7.0.4~rc2-1~bpo10+2 amd64 LibreOffice UNO runtime environment -- SAL helpers for C++ library ii libunoil-java 1:7.0.4~rc2-1~bpo10+2 all LibreOffice UNO runtime environment -- UNO interface library (compatibility library) ii libunoloader-java 1:7.0.4~rc2-1~bpo10+2 all LibreOffice UNO runtime environment -- (Java) UNO loader ii mythes-bg 1:6.2.0-1 all Bulgarian Thesaurus for LibreOffice ii mythes-de 20160424-3 all German Thesaurus for OpenOffice.org/LibreOffice ii mythes-en-us 1:6.2.0-1 all English (USA) Thesaurus for LibreOffice ii mythes-fr 1:6.2.0-1 all French Thesaurus for LibreOffice ii mythes-ru 1:6.2.0-1 all Russian Thesaurus for LibreOffice ii python3-uno 1:7.0.4~rc2-1~bpo10+2 amd64 Python-UNO bridge ii uno-libs-private 1:7.0.4~rc2-1~bpo10+2 amd64 LibreOffice UNO runtime environment -- private libraries used by public ones ii unoconv 0.7-1.1 all converter between LibreOffice document formats ii ure 1:7.0.4~rc2-1~bpo10+2 amd64 LibreOffice UNO runtime environment milko@host1 ~ $ dpkg -l | grep libreoffice ii libreoffice 1:6.1.5-3+deb10u6 amd64 office productivity suite (metapackage) ii libreoffice-avmedia-backend-gstreamer 1:6.1.5-3+deb10u6 amd64 GStreamer backend for LibreOffice ii libreoffice-base 1:6.1.5-3+deb10u6 amd64 office productivity suite -- database ii libreoffice-base-core 1:6.1.5-3+deb10u6 amd64 office productivity suite -- shared library ii libreoffice-base-drivers 1:6.1.5-3+deb10u6 amd64 Database connectivity drivers for LibreOffice ii libreoffice-calc 1:6.1.5-3+deb10u6 amd64 office productivity suite -- spreadsheet ii libreoffice-common 1:6.1.5-3+deb10u6 all office productivity suite -- arch-independent files ii libreoffice-core 1:6.1.5-3+deb10u6 amd64 office productivity suite -- arch-dependent files ii libreoffice-draw 1:6.1.5-3+deb10u6 amd64 office productivity suite -- drawing ii libreoffice-emailmerge 1:4.3.3-2+deb8u7 all transitional package for LibreOffices email mail merge rc libreoffice-filter-binfilter 1:3.5.4+dfsg2-0+deb7u2 amd64 office productivity suite -- legacy filters (e.g. StarOffice 5.2) ii libreoffice-gtk2 1:6.1.5-3+deb10u6 amd64 office productivity suite -- GTK+ 2 integration ii libreoffice-gtk3 1:6.1.5-3+deb10u6 amd64 office productivity suite -- GTK+ 3 integration ii libreoffice-impress 1:6.1.5-3+deb10u6 amd64 office productivity suite -- presentation ii libreoffice-java-common 1:6.1.5-3+deb10u6 all office productivity suite -- arch-independent Java support files ii libreoffice-kde5 1:6.1.5-3+deb10u6 amd64 office productivity suite -- KDE 5 integration ii libreoffice-l10n-bg 1:6.1.5-3+deb10u6 all office productivity suite -- Bulgarian language package ii libreoffice-librelogo 1:6.1.5-3+deb10u6 all Logo-like progamming language for LibreOffice ii libreoffice-lightproof-en 0.4.3+1.5+git20140515-2 all Lightproof grammar checker for LibreOffice (English) ii libreoffice-math 1:6.1.5-3+deb10u6 amd64 office productivity suite -- equation editor ii libreoffice-nlpsolver 0.9+LibO6.1.5-3+deb10u6 all "Solver for Nonlinear Programming" extension for LibreOffice ii libreoffice-ogltrans 1:6.1.5-3+deb10u6 all transitional package for libreoffice-ogltrans ii libreoffice-pdfimport 1:6.1.5-3+deb10u6 all transitional package for PDF Import component for LibreOffice ii libreoffice-report-builder 1:6.1.5-3+deb10u6 all LibreOffice component for building database reports ii libreoffice-report-builder-bin 1:6.1.5-3+deb10u6 amd64 LibreOffice component for building database reports -- libraries ii libreoffice-script-provider-bsh 1:6.1.5-3+deb10u6 all BeanShell script support provider for LibreOffice scripting framework ii libreoffice-script-provider-js 1:6.1.5-3+deb10u6 all JavaScript script support provider for LibreOffice scripting framework ii libreoffice-script-provider-python 1:6.1.5-3+deb10u6 all Python script support provider for LibreOffice scripting framework ii libreoffice-sdbc-firebird 1:6.1.5-3+deb10u6 amd64 Firebird SDBC driver for LibreOffice ii libreoffice-sdbc-hsqldb 1:6.1.5-3+deb10u6 amd64 HSQLDB SDBC driver for LibreOffice ii libreoffice-sdbc-postgresql 1:6.1.5-3+deb10u6 amd64 PostgreSQL SDBC driver for LibreOffice ii libreoffice-style-breeze 1:6.1.5-3+deb10u6 all office productivity suite -- Breeze symbol style ii libreoffice-style-colibre 1:6.1.5-3+deb10u6 all office productivity suite -- colibre symbol style ii libreoffice-style-elementary 1:6.1.5-3+deb10u6 all office productivity suite -- Elementary symbol style ii libreoffice-style-sifr 1:6.1.5-3+deb10u6 all office productivity suite -- Sifr symbol style ii libreoffice-style-tango 1:6.1.5-3+deb10u6 all office productivity suite -- Tango symbol style ii libreoffice-wiki-publisher 1.2.0+LibO6.1.5-3+deb10u6 all LibreOffice extension for working with MediaWiki articles ii libreoffice-writer 1:6.1.5-3+deb10u6 amd64 office productivity suite -- word processor milko@milko-desktop ~ $ dpkg -l | grep -i -e libreoffice -e 1:6.1.5-3+deb10u6 ii libreoffice 1:6.1.5-3+deb10u6 amd64 office productivity suite (metapackage) ii libreoffice-avmedia-backend-gstreamer 1:6.1.5-3+deb10u6 amd64 GStreamer backend for LibreOffice ii libreoffice-base 1:6.1.5-3+deb10u6 amd64 office productivity suite -- database ii libreoffice-base-core 1:6.1.5-3+deb10u6 amd64 office productivity suite -- shared library ii libreoffice-base-drivers 1:6.1.5-3+deb10u6 amd64 Database connectivity drivers for LibreOffice ii libreoffice-calc 1:6.1.5-3+deb10u6 amd64 office productivity suite -- spreadsheet ii libreoffice-common 1:6.1.5-3+deb10u6 all office productivity suite -- arch-independent files ii libreoffice-core 1:6.1.5-3+deb10u6 amd64 office productivity suite -- arch-dependent files ii libreoffice-draw 1:6.1.5-3+deb10u6 amd64 office productivity suite -- drawing ii libreoffice-emailmerge 1:4.3.3-2+deb8u7 all transitional package for LibreOffices email mail merge rc libreoffice-filter-binfilter 1:3.5.4+dfsg2-0+deb7u2 amd64 office productivity suite -- legacy filters (e.g. StarOffice 5.2) ii libreoffice-gtk2 1:6.1.5-3+deb10u6 amd64 office productivity suite -- GTK+ 2 integration ii libreoffice-gtk3 1:6.1.5-3+deb10u6 amd64 office productivity suite -- GTK+ 3 integration ii libreoffice-impress 1:6.1.5-3+deb10u6 amd64 office productivity suite -- presentation ii libreoffice-java-common 1:6.1.5-3+deb10u6 all office productivity suite -- arch-independent Java support files ii libreoffice-kde5 1:6.1.5-3+deb10u6 amd64 office productivity suite -- KDE 5 integration ii libreoffice-l10n-bg 1:6.1.5-3+deb10u6 all office productivity suite -- Bulgarian language package ii libreoffice-librelogo 1:6.1.5-3+deb10u6 all Logo-like progamming language for LibreOffice ii libreoffice-lightproof-en 0.4.3+1.5+git20140515-2 all Lightproof grammar checker for LibreOffice (English) ii libreoffice-math 1:6.1.5-3+deb10u6 amd64 office productivity suite -- equation editor ii libreoffice-nlpsolver 0.9+LibO6.1.5-3+deb10u6 all "Solver for Nonlinear Programming" extension for LibreOffice ii libreoffice-ogltrans 1:6.1.5-3+deb10u6 all transitional package for libreoffice-ogltrans ii libreoffice-pdfimport 1:6.1.5-3+deb10u6 all transitional package for PDF Import component for LibreOffice ii libreoffice-report-builder 1:6.1.5-3+deb10u6 all LibreOffice component for building database reports ii libreoffice-report-builder-bin 1:6.1.5-3+deb10u6 amd64 LibreOffice component for building database reports -- libraries ii libreoffice-script-provider-bsh 1:6.1.5-3+deb10u6 all BeanShell script support provider for LibreOffice scripting framework ii libreoffice-script-provider-js 1:6.1.5-3+deb10u6 all JavaScript script support provider for LibreOffice scripting framework ii libreoffice-script-provider-python 1:6.1.5-3+deb10u6 all Python script support provider for LibreOffice scripting framework ii libreoffice-sdbc-firebird 1:6.1.5-3+deb10u6 amd64 Firebird SDBC driver for LibreOffice ii libreoffice-sdbc-hsqldb 1:6.1.5-3+deb10u6 amd64 HSQLDB SDBC driver for LibreOffice ii libreoffice-sdbc-postgresql 1:6.1.5-3+deb10u6 amd64 PostgreSQL SDBC driver for LibreOffice ii libreoffice-style-breeze 1:6.1.5-3+deb10u6 all office productivity suite -- Breeze symbol style ii libreoffice-style-colibre 1:6.1.5-3+deb10u6 all office productivity suite -- colibre symbol style ii libreoffice-style-elementary 1:6.1.5-3+deb10u6 all office productivity suite -- Elementary symbol style ii libreoffice-style-sifr 1:6.1.5-3+deb10u6 all office productivity suite -- Sifr symbol style ii libreoffice-style-tango 1:6.1.5-3+deb10u6 all office productivity suite -- Tango symbol style ii libreoffice-wiki-publisher 1.2.0+LibO6.1.5-3+deb10u6 all LibreOffice extension for working with MediaWiki articles ii libreoffice-writer 1:6.1.5-3+deb10u6 amd64 office productivity suite -- word processor ii mythes-de 20160424-3 all German Thesaurus for OpenOffice.org/LibreOffice ii mythes-en-us 1:6.2.0-1 all English (USA) Thesaurus for LibreOffice ii mythes-fr 1:6.2.0-1 all French Thesaurus for LibreOffice ii mythes-ru 1:6.2.0-1 all Russian Thesaurus for LibreOffice ii python3-uno 1:6.1.5-3+deb10u6 amd64 Python-UNO bridge ii uno-libs3 6.1.5-3+deb10u6 amd64 LibreOffice UNO runtime environment -- public shared libraries ii ure 6.1.5-3+deb10u6 amd64 LibreOffice UNO runtime environment -- System Information: Debian Release: 10.8 APT prefers stable-updates APT policy: (500, 'stable-updates'), (500, 'stable-debug'), (500, 'stable') Architecture: amd64 (x86_64) Foreign Architectures: i386 Kernel: Linux 4.19.0-13-amd64 (SMP w/4 CPU cores) Kernel taint flags: TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE Locale: LANG=bg_BG.UTF-8, LC_CTYPE=bg_BG.UTF-8 (charmap=UTF-8), LANGUAGE=bg_BG.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Init: systemd (via /run/systemd/system) LSM: AppArmor: enabled Versions of packages libreoffice-calc depends on: ii coinor-libcbc3 2.9.9+repack1-1 ii coinor-libcoinmp1v5 1.8.3-2+b11 ii coinor-libcoinutils3v5 2.10.14+repack1-1 ii libatlas3-base [liblapack.so.3] 3.10.3-8 ii libblas3 [libblas.so.3] 3.8.0-2 ii libboost-filesystem1.67.0 1.67.0-13+deb10u1 ii libboost-iostreams1.67.0 1.67.0-13+deb10u1 ii libbz2-1.0 1.0.6-9.2~deb10u1 ii libc6 2.28-10 ii libetonyek-0.1-1 0.1.9-1 ii libgcc1 1:8.3.0-6 ii libicu63 63.1-6+deb10u1 ii liblapack3 [liblapack.so.3] 3.8.0-2 ii liblcms2-2 2.9-3 ii libmwaw-0.3-3 0.3.14-1 ii libodfgen-0.1-1 0.1.7-1 ii liborcus-0.14-0 0.14.1-6 ii libreoffice-base-core 1:6.1.5-3+deb10u6 ii libreoffice-core 1:6.1.5-3+deb10u6 ii librevenge-0.0-0 0.0.4-6 ii libstaroffice-0.0-0 0.0.6-1 ii libstdc++6 8.3.0-6 ii libwps-0.4-4 0.4.10-1 ii libxml2 2.9.4+dfsg1-7+deb10u1 ii lp-solve 5.5.0.15-4+b1 ii uno-libs3 6.1.5-3+deb10u6 ii ure 6.1.5-3+deb10u6 ii zlib1g 1:1.2.11.dfsg-1 libreoffice-calc recommends no packages. Versions of packages libreoffice-calc suggests: ii mesa-opencl-icd 18.3.6-2+deb10u1 ii ocl-icd-libopencl1 2.2.12-2 Versions of packages libreoffice-core depends on: ii fontconfig 2.13.1-2 ii fonts-opensymbol 2:102.10+LibO6.1.5-3+deb10u6 ii libboost-date-time1.67.0 1.67.0-13+deb10u1 ii libboost-locale1.67.0 1.67.0-13+deb10u1 ii libc6 2.28-10 ii libcairo2 1.16.0-4+deb10u1 ii libclucene-contribs1v5 2.3.3.4+dfsg-1 ii libclucene-core1v5 2.3.3.4+dfsg-1 ii libcmis-0.5-5v5 0.5.2-1 ii libcups2 2.2.10-6+deb10u4 ii libcurl3-gnutls 7.64.0-4+deb10u1 ii libdbus-1-3 1.12.20-0+deb10u1 ii libdbus-glib-1-2 0.110-4 ii libdconf1 0.30.1-2 ii libeot0 0.01-5 ii libepoxy0 1.5.3-0.1 ii libexpat1 2.2.6-2+deb10u1 ii libexttextcat-2.0-0 3.4.5-1 ii libfontconfig1 2.13.1-2 ii libfreetype6 2.9.1-3+deb10u2 ii libgcc1 1:8.3.0-6 ii libglib2.0-0 2.58.3-2+deb10u2 ii libgpgmepp6 1.12.0-6 ii libgraphite2-3 1.3.13-7 ii libharfbuzz-icu0 2.3.1-1 ii libharfbuzz0b 2.3.1-1 ii libhunspell-1.7-0 1.7.0-2 ii libhyphen0 2.8.8-7 ii libice6 2:1.0.9-2 ii libicu63 63.1-6+deb10u1 ii libjpeg62-turbo 1:1.5.2-2+deb10u1 ii liblcms2-2 2.9-3 ii libldap-2.4-2 2.4.47+dfsg-3+deb10u6 ii libmythes-1.2-0 2:1.2.4-3 ii libneon27-gnutls 0.30.2-3 ii libnspr4 2:4.20-1 ii libnss3 2:3.42.1-1+deb10u3 ii libnumbertext-1.0-0 1.0.5-1 ii libodfgen-0.1-1 0.1.7-1 ii liborcus-0.14-0 0.14.1-6 ii libpng16-16 1.6.36-6 ii libpoppler82 0.71.0-5 ii librdf0 1.0.17-1.1+b1 ii libreoffice-common 1:6.1.5-3+deb10u6 ii librevenge-0.0-0 0.0.4-6 ii libsm6 2:1.2.3-1 ii libstdc++6 8.3.0-6 ii libx11-6 2:1.6.7-1+deb10u1 ii libxext6 2:1.3.3-1+b2 ii libxinerama1 2:1.1.4-2 ii libxml2 2.9.4+dfsg1-7+deb10u1 ii libxmlsec1 1.2.27-2 ii libxmlsec1-nss 1.2.27-2 ii libxrandr2 2:1.5.1-1 ii libxrender1 1:0.9.10-1 ii libxslt1.1 1.1.32-2.2~deb10u1 ii uno-libs3 6.1.5-3+deb10u6 ii ure 6.1.5-3+deb10u6 ii zlib1g 1:1.2.11.dfsg-1 Versions of packages libreoffice-core recommends: ii libpaper-utils 1.1.28 -- no debconf information On Sunday, 7 March 2021, 14:18:33 EET Salvatore Bonaccorso wrote: > Hi Milko, > > On Sat, Feb 27, 2021 at 08:36:31PM +0200, Milko Krachounov wrote: > > Package: libreoffice-calc > > Version: 1:6.1.5-3+deb10u6 > > Severity: grave > > Tags: security > > Justification: user security hole > > > > Dear Maintainer, > > > > When opening any CSV file with LibreOffice Calc, Calc opens and executes > > encodings.py from the current working directory. That presumably happens > > because > > > > Some file managers, including Krusader and mc, would launch localc in the > > current directory, as would running it from the command line (such as > > `localc file.csv'), thereby running encodings.py from the directory > > containing the file. > > > > The issue is not present when LibreOffice is launched through the > > application launcher, and the file is opened later through whatever > > means (neither Open file, nor through a file manager or the command > > line, since localc already operates in one's $HOME in that instance) > > > > To reproduce the issue, one needs to: > > 1. Close LibreOffice *completely* > > 2. In an empty directory, create "encodings.py" which raises an exception > > 3. In the same directory (for simplicity), create "file.csv" with some > > > > rows. > > > > 4. Open "file.csv" with `localc ./file.csv' using the directory containing > > > > "encodings.py" (double clicking in krusader and mc leads to the same > > result) > > > > The result is that LibreOffice crashes with the Python exception raised > > by the rogue encodings.py, and then exits with an error that reads: > > Fatal Python error: initfsencoding: Unable to get the locale encoding > > > > An offer is made to recover the unsaved file (but the list is empty), > > relaunching LO sometimes leads to new crashes. > > > > This is NOT the only way the issue happens, I was able to get the > > same crash while clicking through the menus or editing an .ods > > which initially didn't cause a crash, but those aren't deterministically > > reproduced, whereas the .csv route seems to guarantee a crash for me > > even when the .csv is ASCII. > > > > The problem is present in both Debian Stable (1:6.1.5-3+deb10u6), and > > Buster Backports (1:7.0.4~rc2-1~bpo10+2). No extensions not installed > > by apt are present on either machine (on the one with 6.1.5 I never > > installed any, and on the 7.0.4 I'm trusting what the LO extension > > manager is telling me, since I cannot recall for sure) > > > > Here's the console chatter: > > > > # Test on the host with 1:7.0.4~rc2-1~bpo10+2 - hostname is censored > > milko@host2 ~/Временна/LOSecurity $ cat > encodings.py > > raise NotImplementedError("Darth Vader, Obi-Wan and Ahsoka walk into a > > bar") milko@host2 ~/Временна/LOSecurity $ cat > test.csv > > Column 1;Column 2;Column 3 > > текст;ຂໍ້ຄວາມ;text > > milko@host2 ~/Временна/LOSecurity $ localc test.csv > > Fatal Python error: initfsencoding: Unable to get the locale encoding > > > > Traceback (most recent call last): > > File "/home/milko/Временна/LOSecurity/encodings.py", line 1, in <module> > > > > NotImplementedError: Darth Vader, Obi-Wan and Ahsoka walk into a bar > > Fatal Python error: initfsencoding: Unable to get the locale encoding > > > > Traceback (most recent call last): > > File "/home/milko/Временна/LOSecurity/encodings.py", line 1, in <module> > > > > NotImplementedError: Darth Vader, Obi-Wan and Ahsoka walk into a bar > > milko@host2 ~/Временна/LOSecurity $ cat > test2.csv > > Column 1;Column 2;Column 3 > > text1;text2;text3 > > milko@host2 ~/Временна/LOSecurity $ localc test2.csv > > Fatal Python error: initfsencoding: Unable to get the locale encoding > > > > Traceback (most recent call last): > > File "/home/milko/Временна/LOSecurity/encodings.py", line 1, in <module> > > > > NotImplementedError: Darth Vader, Obi-Wan and Ahsoka walk into a bar > > Application Error > > milko@host2 ~/Временна/LOSecurity $ > > > > > > # Test on the host with 1:6.1.5-3+deb10u6 - hostname is censored > > # The encodings.py and test.csv were copied from host2 > > milko@host1 ~/Временни/LOSecurity $ localc test2.csv > > Fatal Python error: initfsencoding: Unable to get the locale encoding > > > > Traceback (most recent call last): > > File "/home/milko/Временни/LOSecurity/encodings.py", line 1, in <module> > > > > NotImplementedError: Darth Vader, Obi-Wan and Ahsoka walk into a bar > > milko@host1 ~/Временни/LOSecurity $ lowriter > > Fatal Python error: initfsencoding: Unable to get the locale encoding > > > > Traceback (most recent call last): > > File "/home/milko/Временни/LOSecurity/encodings.py", line 1, in <module> > > > > NotImplementedError: Darth Vader, Obi-Wan and Ahsoka walk into a bar > > ^C > > milko@host1 ~/Временни/LOSecurity $ > > > > > > LO packages installed on host1 and host2. I do apologize for the untidy > > mess with transitional and unpurged packages and leftover from the dawn of > > time (especially on host2) -- I didn't expect someone to be looking > > through > > my messy house -- but I have to leave them here in case one of them comes > > responsible. > > [...] > > Thanks for the report. > > Can yu pleas make this directly a public report in the Debian BTS? > > Regards, > Salvatore
LOSecurity.tar.gz
Description: application/compressed-tar