These updates have been published. Thanks!
https://ubuntu.com/security/notices/USN-7228-1
** Changed in: libreoffice (Ubuntu Focal)
Status: In Progress => Fix Released
** Changed in: libreoffice (Ubuntu Jammy)
Status: In Progress => Fix Released
** Changed in: libreoffice (Ubuntu Noble)
Status: In Progress => Fix Released
** Changed in: libreoffice (Ubuntu Oracular)
Status: In Progress => Fix Released
--
You received this bug notification because you are a member of Desktop
Packages, which is subscribed to libreoffice in Ubuntu.
https://bugs.launchpad.net/bugs/2095307
Title:
CVE-2024-12425 and CVE-2024-12426
Status in libreoffice package in Ubuntu:
Fix Released
Status in libreoffice source package in Focal:
Fix Released
Status in libreoffice source package in Jammy:
Fix Released
Status in libreoffice source package in Noble:
Fix Released
Status in libreoffice source package in Oracular:
Fix Released
Status in libreoffice source package in Plucky:
Fix Released
Bug description:
CVE-2024-12425: "Path traversal leading to arbitrary .ttf file write"
https://www.libreoffice.org/about-us/security/advisories/cve-2024-12425/
https://ubuntu.com/security/CVE-2024-12425
CVE-2024-12426: "URL fetching can be used to exfiltrate arbitrary INI file
values and environment variables"
https://www.libreoffice.org/about-us/security/advisories/cve-2024-12426/
https://ubuntu.com/security/CVE-2024-12426
focal:
https://git.launchpad.net/~libreoffice/ubuntu/+source/libreoffice/log/?h=wip/focal-6.4
jammy:
https://git.launchpad.net/~libreoffice/ubuntu/+source/libreoffice/log/?h=wip/jammy-7.3
noble:
https://git.launchpad.net/~libreoffice/ubuntu/+source/libreoffice/log/?h=wip/noble-24.2
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/libreoffice/+bug/2095307/+subscriptions
--
Mailing list: https://launchpad.net/~desktop-packages
Post to : [email protected]
Unsubscribe : https://launchpad.net/~desktop-packages
More help : https://help.launchpad.net/ListHelp
