Affected: AlmaLinux:9: autocorr-af, AlmaLinux:9: autocorr-bg, AlmaLinux:9: autocorr-ca, AlmaLinux:9: autocorr-cs, AlmaLinux:9: autocorr-da, AlmaLinux:9: autocorr-de, AlmaLinux:9: autocorr-dsb, AlmaLinux:9: autocorr-el, AlmaLinux:9: autocorr-en, AlmaLinux:9: autocorr-es and 169 more

LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a drawing program. LibreOffice replaces OpenOffice and provides a similar but enhanced and extended office suite.

Security Fix(es):

* libreoffice: Empty entry in Java class path (CVE-2022-38745) * libreoffice: Array index underflow in Calc formula parsing (CVE-2023-0950) * libreoffice: Arbitrary file write (CVE-2023-1183) * libreoffice: Remote documents loaded without prompt via IFrame (CVE-2023-2255)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Improper access control in editor components of The Document Foundation LibreOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt. In the affected versions of LibreOffice documents that used "floating frames" linked to external files, would load the contents of those frames without prompting the user for permission to do so. This was inconsistent with the treatment of other linked content in LibreOffice. This issue affects: The Document Foundation LibreOffice 7.4 versions prior to 7.4.7; 7.5 versions prior to 7.5.3.

Improper access control in editor components of The Document Foundation LibreOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt. In the affected versions of LibreOffice documents that used "floating frames" linked to external files, would load the contents of those frames without prompting the user for permission to do so. This was inconsistent with the treatment of other linked content in LibreOffice. This issue affects: The Document Foundation LibreOffice 7.4 versions prior to 7.4.7; 7.5 versions prior to 7.5.3.

libreoffice: Empty entry in Java class path libreoffice: Array index underflow in Calc formula parsing libreoffice: Arbitrary file write libreoffice: Remote documents loaded without prompt via IFrame

Feature update for LibreOffice

Affected: Ubuntu:20.04:LTS: libreoffice, Ubuntu:22.04:LTS: libreoffice

Improper access control in editor components of The Document Foundation LibreOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt. In the affected versions of LibreOffice documents that used "floating frames" linked to external files, would load the contents of those frames without prompting the user for permission to do so. This was inconsistent with the treatment of other linked content in LibreOffice. This issue affects: The Document Foundation LibreOffice 7.4 versions prior to 7.4.7; 7.5 versions prior to 7.5.3.

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in LibreOffice ausnutzen, um beliebigen Programmcode auszuführen und Sicherheitsmaßnahmen zu umgehen.