-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3915-1 [email protected] https://www.debian.org/lts/security/ Bastien Roucariès October 12, 2024 https://wiki.debian.org/LTS - -------------------------------------------------------------------------
Package : libreoffice Version : 1:7.0.4-4+deb11u11 CVE ID : CVE-2024-7788 Various file formats are based on the zip file format. In cases of corruption of the underlying zip's central directory, LibreOffice offers a "repair mode" which will attempt to recover the zip file structure by scanning for secondary local file headers in the zip to reconstruct the document. Prior to this fix, in the case of digitally signed zip files, an attacker could construct a document which, when repaired, reported a signature status not valid for the recovered file. Previously if verification failed the user could choose to ignore the failure and enable the macros anyway. Repair document mode has to be inherently tolerant, so now in fixed versions all signatures are implied to be invalid in recovery mode. For Debian 11 bullseye, this problem has been fixed in version 1:7.0.4-4+deb11u11. We recommend that you upgrade your libreoffice packages. For the detailed security status of libreoffice please refer to its security tracker page at: https://security-tracker.debian.org/tracker/libreoffice Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS -----BEGIN PGP SIGNATURE----- iQJFBAEBCgAvFiEEXQGHuUCiRbrXsPVqADoaLapBCF8FAmcKXN4RHHJvdWNhQGRl Ymlhbi5vcmcACgkQADoaLapBCF+QLA//QX1YOFhChSz2ByXWd14DyN0nu6cb0SHJ 4BQWFljDgpatckmIZ83a4SIL8pgEFSGaQCCzB5OidVO19/FDZ/I+XvanBYy33HF+ ihqFd/jf8PboTlg+pWIXG1TOm16hAuP3UxDFdn+qD0brgULc1kdd3eIGNHmci4rS /JzXLtYn9F2vVdhleJDlU4ahawvrT376g8Ed3Kpl8y7kDtMbw5AMnqUMquwDJTtK PTG+M0jjIrBuRX8EYqZ+qz0Gku4JG3rdrfiIfjeR1jLtw45GIC/px5G1FzeHU4sB Hl9enMyYBGj3k8KPeTJSz1y16f/PN42eNjnUIl+2Tf0SbAylWK81OrJat1tVXC6q af/jfodNEnWqiRMRbW5nZhNk5qEyKNnkQDaUXNPuHnlxpsn6NOxU9pYDLrtJ3JrL yuyiNcDEnrxAvOdrrzC5OkctOX6wfPcYHCZsb7/yZ6YPBSZIYNOxrd1ONKfvmCbf YkYGxE02EFrPZtebDYyN1+BFhmmUsmjRr9RTVOyoxp7attXjgyOYC3jau6mIuQ/V m5OEAif+8xvNJcCb/FrQcRTY5omDflJjQYzFtS0XyhGbfoD0BDy9bgmz9MZV5Fz+ HDBV6zaPXamRMbtmQKkcVA5g3MI7jqerDTeRiY5jkUsyzw9RgRN7WLmOZ4bmQOiR otVkB7zrYQE= =XZME -----END PGP SIGNATURE-----
