import Oracle_OSS libreoffice-7.1.8.1-15.0.1.el9_8.2

SOURCES/0001-CVE-2026-8357-A-formula-of-length-L-needs-L-plus-1-slots.patch

@@ -0,0 +1,37 @@
+From a28cead4b7796642d946173b479281a6272117f2 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolan.mcnamara@collabora.com>
+Date: Sun, 26 Apr 2026 17:12:34 +0100
+Subject: [PATCH] A formula of length L, composed entirely of open tokens,
+ needs L+1 slots
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
+Change-Id: I7cf1fd4fdaca780a8f0cf0d0b9d10def9b3af1ef
+Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/1690
+Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
+(cherry picked from commit 0b7a9149d7c7b5e044bb4f02668297bdf41b64d6)
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/205090
+Tested-by: Jenkins
+Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
+---
+ sc/source/core/tool/compiler.cxx | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/sc/source/core/tool/compiler.cxx b/sc/source/core/tool/compiler.cxx
+index d1a6c8937ec61..f5b87efba2836 100644
+--- a/sc/source/core/tool/compiler.cxx
++++ b/sc/source/core/tool/compiler.cxx
+@@ -5058,8 +5058,9 @@ std::unique_ptr<ScTokenArray> ScCompiler::CompileString( const OUString& rFormul
+     bool bUseFunctionStack = (bPODF || bOOXML);
+     const size_t nAlloc = 512;
+     FunctionStack aFuncs[ nAlloc ];
+-    FunctionStack* pFunctionStack = (bUseFunctionStack && o3tl::make_unsigned(rFormula.getLength()) > nAlloc ?
+-         new FunctionStack[rFormula.getLength()] : &aFuncs[0]);
++    // A formula of length L composed entirely of open tokens needs L+1 slots,
++    FunctionStack* pFunctionStack = (bUseFunctionStack && o3tl::make_unsigned(rFormula.getLength()) >= nAlloc ?
++         new FunctionStack[rFormula.getLength() + 1] : &aFuncs[0]);
+     pFunctionStack[0].eOp = ocNone;
+     pFunctionStack[0].nSep = 0;
+     size_t nFunction = 0;

SPECS/libreoffice.spec

@@ -13,7 +13,7 @@ ExcludeArch:    %{ix86}
 %global libo_buildfix %{nil}
 # rhbz#715152 state vendor
 %if 0%{?rhel}
-%global vendoroption --with-vendor="Red Hat, Inc."
+%global vendoroption --with-vendor="Oracle America, Inc."
 %endif
 %if 0%{?fedora}
 %global vendoroption --with-vendor="The Fedora Project"
@@ -62,7 +62,7 @@ Summary:        Free Software Productivity Suite
 Name:           libreoffice
 Epoch:          1
 Version:        %{libo_version}.1
-Release:        15%{?libo_prerelease}%{?dist}.1
+Release:        15%{?libo_prerelease}.0.1%{?dist}.2
 License:        (MPLv1.1 or LGPLv3+) and LGPLv3 and LGPLv2+ and BSD and (MPLv1.1 or GPLv2 or LGPLv2 or Netscape) and Public Domain and ASL 2.0 and MPLv2.0 and CC0
 URL:            http://www.libreoffice.org/
 
@@ -306,6 +306,8 @@ Patch45: 0001-CVE-2024-6472-remove-ability-to-trust-not-validated-macro-signatur
 Patch46: 0001-CVE-2025-1080-Filter-out-more-unwanted-command-URIs.patch
 # https://gerrit.libreoffice.org/c/core/+/202756
 Patch47: 0001-CVE-2026-4430-Conform-AlignEngine-parsing.patch
+# https://github.com/LibreOffice/core/commit/a28cead4b7796642d946173b479281a6272117f2
+Patch48: 0001-CVE-2026-8357-A-formula-of-length-L-needs-L-plus-1-slots.patch
 
 # not upstreamed
 Patch500: 0001-disable-libe-book-support.patch
@@ -1045,16 +1047,24 @@ rm -rf git-hooks */git-hooks
 %global __scm git_am
 %__scm_setup_git_am
 
-#Customize Palette to add Red Hat colours
+#Customize Palette to add Oracle colours
 (head -n -1 extras/source/palettes/standard.soc && \
- echo -e '  <draw:color draw:name="Red Hat 1" draw:color="#cc0000"/>
-  <draw:color draw:name="Red Hat 2" draw:color="#0093d9"/>
-  <draw:color draw:name="Red Hat 3" draw:color="#ff8d00"/>
-  <draw:color draw:name="Red Hat 4" draw:color="#abb400"/>
-  <draw:color draw:name="Red Hat 5" draw:color="#4e376b"/>' && \
- tail -n 1 extras/source/palettes/standard.soc) > redhat.soc
-mv -f redhat.soc extras/source/palettes/standard.soc
-git commit -q -a -m 'add Red Hat colors to palette'
+echo -e '  <draw:color draw:name="Oracle Bark" draw:color="#312d2a"/>
+<draw:color draw:name="Oracle Red" draw:color="#c74634"/>
+<draw:color draw:name="Oracle secondary: Sunrise" draw:color="#facd62"/>
+<draw:color draw:name="Oracle secondary: Ember" draw:color="#ae562c"/>
+<draw:color draw:name="Oracle secondary: Fog" draw:color="#94afaf"/>
+<draw:color draw:name="Oracle secondary: Ivy" draw:color="#759c6c"/>
+<draw:color draw:name="Oracle secondary: Sand" draw:color="#e5dbbe"/>
+<draw:color draw:name="Oracle secondary: Ocean" draw:color="#2c5967"/>
+<draw:color draw:name="Oracle secondary: Surf" draw:color="#41817e"/>
+<draw:color draw:name="Oracle secondary: Forest" draw:color="#2b6242"/>
+<draw:color draw:name="Oracle neutral: Air" draw:color="#fcfbfa"/>
+<draw:color draw:name="Oracle neutral: Pebble" draw:color="#8b8580"/>
+<draw:color draw:name="Oracle neutral: Granite" draw:color="#67605b"/>'
+tail -n 1 extras/source/palettes/standard.soc) > oracle.soc
+mv -f oracle.soc extras/source/palettes/standard.soc
+git commit -q -a -m 'add Oracle colors to palette'
 
 # apply patches
 %autopatch -M 99
@@ -1170,6 +1180,7 @@ touch autogen.lastrun
  --without-export-validation \
  --without-fonts \
  --without-lxml \
+ --with-hamcrest=yes \
  --with-gdrive-client-secret="GYWrDtzyZQZ0_g5YoBCC6F0I" \
  --with-gdrive-client-id="457862564325.apps.googleusercontent.com" \
  --enable-python=system \
@@ -2309,6 +2320,15 @@ gtk-update-icon-cache -q %{_datadir}/icons/hicolor &>/dev/null || :
 %{_includedir}/LibreOfficeKit
 
 %changelog
+* Thu Jul 09 2026 Darren Archibald <darren.archibald@oracle.com> - 1:7.1.8.1-15.0.1.el9_8.2
+- Added the --with-hamcrest option to configure.
+- Replace colors with Oracle colors [Orabug: 32120093]
+
+* Tue Jul 07 2026 Tomas Popela <tpopela@redhat.com> - 1:7.1.8.1-15.el9_8.2
+- Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in
+  formula compilation
+- Resolves: RHEL-186057
+
 * Tue May 19 2026 Tomas Popela <tpopela@redhat.com> - 1:7.1.8.1-15.el9_8.1
 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of
   the spec has