[ubuntu/focal-security] libreoffice 1:6.4.7-0ubuntu0.20.04.13 (Accepted)

[Marc Deslauriers]

libreoffice (1:6.4.7-0ubuntu0.20.04.13) focal-security; urgency=medium

  * SECURITY UPDATE: Path traversal leading to arbitrary .ttf file write
    - debian/patches/CVE-2024-12425.patch: be conservative on allowed temp
      font names
    - CVE-2024-12425
  * SECURITY UPDATE: URL fetching can be used to exfiltrate arbitrary INI
      file values and environment variables
    - debian/patches/CVE-2024-12426-1.patch: consider VndSunStarExpand an
      exotic protocol
    - debian/patches/CVE-2024-12426-2.patch: look at 'embedded' protocols too
    - CVE-2024-12426
    - debian/patches/CVE-2024-12426-3.patch: Fix check for further exotic 
      protocols

Date: 2025-01-24 14:18:11.126666+00:00
Changed-By: Rico Tzschichholz <ricotz at web.de>
Signed-By: Marc Deslauriers <marc.deslauriers at canonical.com>
https://launchpad.net/ubuntu/+source/libreoffice/1:6.4.7-0ubuntu0.20.04.13
-------------- next part --------------
Sorry, changesfile not available.