Document Liberation Project libstaroffice before 2017-04-07 has an out-of-bounds write caused by a stack-based buffer overflow related to the DatabaseName::read function in lib/StarWriterStruct.cxx.

LibreOffice was updated to version 6.0.3. Following new features were added :

  - The Notebookbar, although still an experimental feature,     has been enriched with two new variants: Grouped Bar     Full for Writer, Calc and Impress, and Tabbed Compact     for Writer. The Special Characters dialog has been     reworked, with the addition of lists for Recent and     Favorite characters, along with a Search field. The     Customize dialog has also been redesigned, and is now     more modern and intuitive.

  - In Writer, a Form menu has been added, making it easier     to access one of the most powerful     &Atilde;&cent;&Acirc;&#128;&Acirc;&#147; and often     unknown &Atilde;&cent;&Acirc;&#128;&Acirc;&#147;
    LibreOffice features: the ability to design forms, and     create standards-compliant PDF forms. The Find toolbar     has been enhanced with a drop-down list of search types,     to speed up navigation. A new default table style has     been added, together with a new collection of table     styles to reflect evolving visual trends.

  - The Mail Merge function has been improved, and it is now     possible to use either a Writer document or an XLSX file     as data source.

  - In Calc, ODF 1.2-compliant functions SEARCHB, FINDB and     REPLACEB have been added, to improve support for the ISO     standard format. Also, a cell range selection or a     selected group of shapes (images) can be now exported in     PNG or JPG format.

  - In Impress, the default slide size has been switched to     16:9, to support the most recent form factors of screens     and projectors. As a consequence, 10 new Impress     templates have been added, and a couple of old templates     have been updated. Changes in components :

  - The old WikiHelp has been replaced by the new Help     Online system, with attractive web pages that can also     be displayed on mobile devices. In general, LibreOffice     Help has been updated both in terms of contents and     code, with other improvements due all along the life of     the LibreOffice 6 family.

  - User dictionaries now allow automatic affixation or     compounding. This is a general spell checking     improvement in LibreOffice which can speed up work for     Writer users. Instead of manually handling several forms     of a new word in a language with rich morphology or     compounding, the Hunspell spell checker can     automatically recognize a new word with affixes or     compounds, based on a     &Atilde;&cent;&Acirc;&#128;&Acirc;&#156;Grammar     By&Atilde;&cent;&Acirc;&#128;&Acirc;&#157; model.
    Security features and changes :

  - OpenPGP keys can be used to sign ODF documents on all     desktop operating systems, with experimental support for     OpenPGP-based encryption. To enable this feature, users     will have to install the specific GPG software for their     operating systems.

  - Document classification has also been improved, and     allows multiple policies (which are now exported to     OOXML files). In Writer, marking and signing are now     supported at paragraph level. Interoperability changes :

  - OOXML interoperability has been improved in several     areas: import of SmartArt and import/export of ActiveX     controls, support of embedded text documents and     spreadsheets, export of embedded videos to PPTX, export     of cross-references to DOCX, export of MailMerge fields     to DOCX, and improvements to the PPTX filter to prevent     the creation of broken files.

  - New filters for exporting Writer documents to ePub and     importing QuarkXPress files have also been added,     together with an improved filter for importing EMF+     (Enhanced Metafile Format Plus) files as used by     Microsoft Office documents. Some improvements have also     been added to the ODF export filter, making it easier     for other ODF readers to display visuals. The full blog     entry for the 6.0 release can be found here:
    &#9;https://blog.documentfoundation.org/blog/2018/01/31/     libreoffice-6/ The full release notes can be found here:
    &#9;https://wiki.documentfoundation.org/ReleaseNotes/6.0     The libraries that LibreOffice depends on also have been     udpated to their current versions.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

new upstream release

----

Security fix for CVE-2017-9432

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2017-9432

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
109357	SUSE SLED12 / SLES12 Security Update : Recommended update for LibreOffice (SUSE-SU-2018:1076-1)	Nessus	SuSE Local Security Checks	critical
103102	Fedora 25 : libstaroffice (2017-86cfcbbae8)	Nessus	Fedora Local Security Checks	critical
101749	Fedora 26 : libstaroffice (2017-f986009363)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2017-9432

critical

Tenable Plugins

critical

critical

critical