From 0d1ab6ec9324766264ba83420e47ba836f7aec24 Mon Sep 17 00:00:00 2001 From: AlmaLinux RelEng Bot Date: Wed, 15 Jul 2026 07:33:05 -0400 Subject: [PATCH] import Oracle_OSS libreoffice-7.1.8.1-15.0.1.el9_8.2 --- ...-2024-3044-add-notify-for-script-use.patch | 0 ...ula-of-length-L-needs-L-plus-1-slots.patch | 37 ++++++++++++++++ SOURCES/0001-disable-script-dump.patch | 0 ...me-script-macro-support-isn-t-needed.patch | 0 SOURCES/libreoffice-multiliblauncher.sh | 0 SPECS/libreoffice.spec | 42 ++++++++++++++----- 6 files changed, 68 insertions(+), 11 deletions(-) mode change 100644 => 100755 SOURCES/0001-CVE-2024-3044-add-notify-for-script-use.patch create mode 100644 SOURCES/0001-CVE-2026-8357-A-formula-of-length-L-needs-L-plus-1-slots.patch mode change 100644 => 100755 SOURCES/0001-disable-script-dump.patch mode change 100644 => 100755 SOURCES/0003-assume-IFrame-script-macro-support-isn-t-needed.patch mode change 100644 => 100755 SOURCES/libreoffice-multiliblauncher.sh diff --git a/SOURCES/0001-CVE-2024-3044-add-notify-for-script-use.patch b/SOURCES/0001-CVE-2024-3044-add-notify-for-script-use.patch old mode 100644 new mode 100755 diff --git a/SOURCES/0001-CVE-2026-8357-A-formula-of-length-L-needs-L-plus-1-slots.patch b/SOURCES/0001-CVE-2026-8357-A-formula-of-length-L-needs-L-plus-1-slots.patch new file mode 100644 index 0000000..6f12f1a --- /dev/null +++ b/SOURCES/0001-CVE-2026-8357-A-formula-of-length-L-needs-L-plus-1-slots.patch @@ -0,0 +1,37 @@ +From a28cead4b7796642d946173b479281a6272117f2 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= +Date: Sun, 26 Apr 2026 17:12:34 +0100 +Subject: [PATCH] A formula of length L, composed entirely of open tokens, + needs L+1 slots +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Signed-off-by: Caolán McNamara +Change-Id: I7cf1fd4fdaca780a8f0cf0d0b9d10def9b3af1ef +Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/1690 +Tested-by: Jenkins CPCI +(cherry picked from commit 0b7a9149d7c7b5e044bb4f02668297bdf41b64d6) +Reviewed-on: https://gerrit.libreoffice.org/c/core/+/205090 +Tested-by: Jenkins +Reviewed-by: Xisco Fauli +--- + sc/source/core/tool/compiler.cxx | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/sc/source/core/tool/compiler.cxx b/sc/source/core/tool/compiler.cxx +index d1a6c8937ec61..f5b87efba2836 100644 +--- a/sc/source/core/tool/compiler.cxx ++++ b/sc/source/core/tool/compiler.cxx +@@ -5058,8 +5058,9 @@ std::unique_ptr ScCompiler::CompileString( const OUString& rFormul + bool bUseFunctionStack = (bPODF || bOOXML); + const size_t nAlloc = 512; + FunctionStack aFuncs[ nAlloc ]; +- FunctionStack* pFunctionStack = (bUseFunctionStack && o3tl::make_unsigned(rFormula.getLength()) > nAlloc ? +- new FunctionStack[rFormula.getLength()] : &aFuncs[0]); ++ // A formula of length L composed entirely of open tokens needs L+1 slots, ++ FunctionStack* pFunctionStack = (bUseFunctionStack && o3tl::make_unsigned(rFormula.getLength()) >= nAlloc ? ++ new FunctionStack[rFormula.getLength() + 1] : &aFuncs[0]); + pFunctionStack[0].eOp = ocNone; + pFunctionStack[0].nSep = 0; + size_t nFunction = 0; diff --git a/SOURCES/0001-disable-script-dump.patch b/SOURCES/0001-disable-script-dump.patch old mode 100644 new mode 100755 diff --git a/SOURCES/0003-assume-IFrame-script-macro-support-isn-t-needed.patch b/SOURCES/0003-assume-IFrame-script-macro-support-isn-t-needed.patch old mode 100644 new mode 100755 diff --git a/SOURCES/libreoffice-multiliblauncher.sh b/SOURCES/libreoffice-multiliblauncher.sh old mode 100644 new mode 100755 diff --git a/SPECS/libreoffice.spec b/SPECS/libreoffice.spec index d325090..e7580b2 100644 --- a/SPECS/libreoffice.spec +++ b/SPECS/libreoffice.spec @@ -13,7 +13,7 @@ ExcludeArch: %{ix86} %global libo_buildfix %{nil} # rhbz#715152 state vendor %if 0%{?rhel} -%global vendoroption --with-vendor="Red Hat, Inc." +%global vendoroption --with-vendor="Oracle America, Inc." %endif %if 0%{?fedora} %global vendoroption --with-vendor="The Fedora Project" @@ -62,7 +62,7 @@ Summary: Free Software Productivity Suite Name: libreoffice Epoch: 1 Version: %{libo_version}.1 -Release: 15%{?libo_prerelease}%{?dist}.1 +Release: 15%{?libo_prerelease}.0.1%{?dist}.2 License: (MPLv1.1 or LGPLv3+) and LGPLv3 and LGPLv2+ and BSD and (MPLv1.1 or GPLv2 or LGPLv2 or Netscape) and Public Domain and ASL 2.0 and MPLv2.0 and CC0 URL: http://www.libreoffice.org/ @@ -306,6 +306,8 @@ Patch45: 0001-CVE-2024-6472-remove-ability-to-trust-not-validated-macro-signatur Patch46: 0001-CVE-2025-1080-Filter-out-more-unwanted-command-URIs.patch # https://gerrit.libreoffice.org/c/core/+/202756 Patch47: 0001-CVE-2026-4430-Conform-AlignEngine-parsing.patch +# https://github.com/LibreOffice/core/commit/a28cead4b7796642d946173b479281a6272117f2 +Patch48: 0001-CVE-2026-8357-A-formula-of-length-L-needs-L-plus-1-slots.patch # not upstreamed Patch500: 0001-disable-libe-book-support.patch @@ -1045,16 +1047,24 @@ rm -rf git-hooks */git-hooks %global __scm git_am %__scm_setup_git_am -#Customize Palette to add Red Hat colours +#Customize Palette to add Oracle colours (head -n -1 extras/source/palettes/standard.soc && \ - echo -e ' - - - - ' && \ - tail -n 1 extras/source/palettes/standard.soc) > redhat.soc -mv -f redhat.soc extras/source/palettes/standard.soc -git commit -q -a -m 'add Red Hat colors to palette' +echo -e ' + + + + + + + + + + + +' +tail -n 1 extras/source/palettes/standard.soc) > oracle.soc +mv -f oracle.soc extras/source/palettes/standard.soc +git commit -q -a -m 'add Oracle colors to palette' # apply patches %autopatch -M 99 @@ -1170,6 +1180,7 @@ touch autogen.lastrun --without-export-validation \ --without-fonts \ --without-lxml \ + --with-hamcrest=yes \ --with-gdrive-client-secret="GYWrDtzyZQZ0_g5YoBCC6F0I" \ --with-gdrive-client-id="457862564325.apps.googleusercontent.com" \ --enable-python=system \ @@ -2309,6 +2320,15 @@ gtk-update-icon-cache -q %{_datadir}/icons/hicolor &>/dev/null || : %{_includedir}/LibreOfficeKit %changelog +* Thu Jul 09 2026 Darren Archibald - 1:7.1.8.1-15.0.1.el9_8.2 +- Added the --with-hamcrest option to configure. +- Replace colors with Oracle colors [Orabug: 32120093] + +* Tue Jul 07 2026 Tomas Popela - 1:7.1.8.1-15.el9_8.2 +- Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in + formula compilation +- Resolves: RHEL-186057 + * Tue May 19 2026 Tomas Popela - 1:7.1.8.1-15.el9_8.1 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has