diff --git a/.gitignore b/.gitignore index 07521f7..6c83dfd 100644 --- a/.gitignore +++ b/.gitignore @@ -2,14 +2,6 @@ SOURCES/17410483b5b5f267aa18b7e00b65e6e0-hsqldb_1_8_0.zip SOURCES/185d60944ea767075d27247c3162b3bc-unowinreg.dll SOURCES/884ed41809687c3e168fc7c19b16585149ff058eca79acbf3ee784f6630704cc-opens___.ttf SOURCES/a7983f859eafb2677d7ff386a023bc40-xsltml_2.1.2.zip -SOURCES/gpgkey-C2839ECAD9408FBE9531C3E9F434A1EFAFEEAEA3.gpg.asc SOURCES/libreoffice-6.4.7.2.tar.xz -SOURCES/libreoffice-base-symbolic.svg -SOURCES/libreoffice-calc-symbolic.svg -SOURCES/libreoffice-draw-symbolic.svg SOURCES/libreoffice-help-6.4.7.2.tar.xz -SOURCES/libreoffice-impress-symbolic.svg -SOURCES/libreoffice-main-symbolic.svg -SOURCES/libreoffice-math-symbolic.svg SOURCES/libreoffice-translations-6.4.7.2.tar.xz -SOURCES/libreoffice-writer-symbolic.svg diff --git a/.libreoffice.metadata b/.libreoffice.metadata index 21d524c..1ecf977 100644 --- a/.libreoffice.metadata +++ b/.libreoffice.metadata @@ -2,14 +2,6 @@ 0619ed3a89644bef318df67db12045b2b590585b SOURCES/185d60944ea767075d27247c3162b3bc-unowinreg.dll d336802a36ed2c87dd243e7c2f1d0542dace5cca SOURCES/884ed41809687c3e168fc7c19b16585149ff058eca79acbf3ee784f6630704cc-opens___.ttf 2d49e11b0b711970f494294dc3698f05eb294853 SOURCES/a7983f859eafb2677d7ff386a023bc40-xsltml_2.1.2.zip -7b5fd93d787fbc6d9c2d4025d543730ee8dc4559 SOURCES/gpgkey-C2839ECAD9408FBE9531C3E9F434A1EFAFEEAEA3.gpg.asc b29d8cdb3db8d6b317e1cb9117b020d7e676e601 SOURCES/libreoffice-6.4.7.2.tar.xz -54fc749ba924f9ca4e0391caaf579ab344302038 SOURCES/libreoffice-base-symbolic.svg -9de544172d736d59589767000c1f657034a5d53d SOURCES/libreoffice-calc-symbolic.svg -0f6dc4726da0920869354fbe4b2924f9ac569b4a SOURCES/libreoffice-draw-symbolic.svg ca7e087ef62f30c033db84ceb0f6a4021f53653e SOURCES/libreoffice-help-6.4.7.2.tar.xz -8c74dd667c660cc643c4d715dd50491ba92146d5 SOURCES/libreoffice-impress-symbolic.svg -c77acd04a7647b09745f9424ab0f65d52dfcd397 SOURCES/libreoffice-main-symbolic.svg -3857a55644148eb25ed1a594bd00d1262761fb39 SOURCES/libreoffice-math-symbolic.svg 0f74fd6286e71ff2b7c7bc01f41c8972e354d81c SOURCES/libreoffice-translations-6.4.7.2.tar.xz -d4f0674ad46a832120db956cc01a27fdc2060458 SOURCES/libreoffice-writer-symbolic.svg diff --git a/SOURCES/0001-CVE-2024-3044-add-notify-for-script-use.patch b/SOURCES/0001-CVE-2024-3044-add-notify-for-script-use.patch index ebd140f..ad525fd 100644 --- a/SOURCES/0001-CVE-2024-3044-add-notify-for-script-use.patch +++ b/SOURCES/0001-CVE-2024-3044-add-notify-for-script-use.patch @@ -1,4 +1,4 @@ -From 6582f7956313e16ea7df5b7cc961d368c150de0a Mon Sep 17 00:00:00 2001 +From 3c25a1e4885a91b1a2fbfd873633f055caa50745 Mon Sep 17 00:00:00 2001 From: Caolán McNamara Date: Wed, 27 Mar 2024 17:07:20 +0000 Subject: [PATCH] add notify for script use @@ -8,13 +8,13 @@ Reviewed-on: https://gerrit.libreoffice.org/c/core/+/165410 Tested-by: Jenkins CollaboraOffice Reviewed-by: Miklos Vajna (cherry picked from commit a4a5c6b63599bca1f084bb90875f6fd8e15184ac) -Reviewed-on: https://gerrit.libreoffice.org/c/core/+/167419 +Reviewed-on: https://gerrit.libreoffice.org/c/core/+/167421 Tested-by: Caolán McNamara Reviewed-by: Caolán McNamara --- diff --git a/xmloff/source/draw/eventimp.cxx b/xmloff/source/draw/eventimp.cxx -index 226caca..bcf67c4 100644 +index f9e10c1..fcc36f9 100644 --- a/xmloff/source/draw/eventimp.cxx +++ b/xmloff/source/draw/eventimp.cxx @@ -231,6 +231,9 @@ diff --git a/SOURCES/0001-CVE-2024-6472-remove-ability-to-trust-not-validated-macro-signatur.patch b/SOURCES/0001-CVE-2024-6472-remove-ability-to-trust-not-validated-macro-signatur.patch new file mode 100644 index 0000000..a3b4946 --- /dev/null +++ b/SOURCES/0001-CVE-2024-6472-remove-ability-to-trust-not-validated-macro-signatur.patch @@ -0,0 +1,81 @@ +From 4e997c62fd6edf6c3fe9e553cc92c77fd48f039c Mon Sep 17 00:00:00 2001 +Message-ID: <4e997c62fd6edf6c3fe9e553cc92c77fd48f039c.1723718921.git.erack@redhat.com> +From: Sarper Akdemir +Date: Tue, 11 Jun 2024 12:39:36 +0200 +Subject: [PATCH] remove ability to trust not validated macro signatures in + high security +MIME-Version: 1.0 +Content-Type: multipart/mixed; boundary="------------erAck-patch-parts" + +This is a multi-part message in MIME format. +--------------erAck-patch-parts +Content-Type: text/plain; charset=UTF-8; format=fixed +Content-Transfer-Encoding: 8bit + + +Giving the user the option to determine if they should trust an +invalid signature in HIGH macro security doesn't make sense. +CommonName of the signature is the most prominent feature presented +and the CommonName of a certificate can be easily forged for an +invalid signature, tricking the user into accepting an invalid +signature. + +in the HIGH macro security setting only show the pop-up to +enable/disable signed macro if the certificate signature can be +validated. + +cherry-picked without UI/String altering bits for 24-2 + +Change-Id: Ia766fb701660160ee5dc9f6e077f4012a44ce721 +Reviewed-on: https://gerrit.libreoffice.org/c/core/+/168667 +Tested-by: Jenkins +Reviewed-by: Sarper Akdemir +(cherry picked from commit 2beaa3be3829303e948d401f492dbfd239d60aad) +Reviewed-on: https://gerrit.libreoffice.org/c/core/+/169525 +Reviewed-by: Thorsten Behrens +Reviewed-on: https://gerrit.libreoffice.org/c/core/+/171306 +Reviewed-by: Caolán McNamara +Tested-by: Caolán McNamara +Reviewed-on: https://gerrit.libreoffice.org/c/core/+/171314 +Reviewed-on: https://gerrit.libreoffice.org/c/core/+/171315 +Reviewed-on: https://gerrit.libreoffice.org/c/core/+/171317 +Reviewed-on: https://gerrit.libreoffice.org/c/core/+/171323 +--- + sfx2/source/doc/docmacromode.cxx | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + + +--------------erAck-patch-parts +Content-Type: text/x-patch; name="0001-remove-ability-to-trust-not-validated-macro-signatur.patch" +Content-Transfer-Encoding: 8bit +Content-Disposition: attachment; filename="0001-remove-ability-to-trust-not-validated-macro-signatur.patch" + +diff --git a/sfx2/source/doc/docmacromode.cxx b/sfx2/source/doc/docmacromode.cxx +index 8a617b1785c6..997a8f739395 100644 +--- a/sfx2/source/doc/docmacromode.cxx ++++ b/sfx2/source/doc/docmacromode.cxx +@@ -229,14 +229,18 @@ namespace sfx2 + // check whether the document is signed with trusted certificate + if ( nMacroExecutionMode != MacroExecMode::FROM_LIST ) + { ++ SignatureState nSignatureState = m_xData->m_rDocumentAccess.getScriptingSignatureState(); ++ + // the trusted macro check will also retrieve the signature state ( small optimization ) + const SvtSecurityOptions aSecOption; + const bool bAllowUIToAddAuthor = nMacroExecutionMode != MacroExecMode::FROM_LIST_AND_SIGNED_NO_WARN + && (nMacroExecutionMode == MacroExecMode::ALWAYS_EXECUTE +- || !aSecOption.IsReadOnly(SvtSecurityOptions::EOption::MacroTrustedAuthors)); ++ || !aSecOption.IsReadOnly(SvtSecurityOptions::EOption::MacroTrustedAuthors)) ++ && (nMacroExecutionMode != MacroExecMode::FROM_LIST_AND_SIGNED_WARN ++ || nSignatureState == SignatureState::OK); ++ + const bool bHasTrustedMacroSignature = m_xData->m_rDocumentAccess.hasTrustedScriptingSignature(bAllowUIToAddAuthor); + +- SignatureState nSignatureState = m_xData->m_rDocumentAccess.getScriptingSignatureState(); + if ( nSignatureState == SignatureState::BROKEN ) + { + if (!bAllowUIToAddAuthor) + +--------------erAck-patch-parts-- + + diff --git a/SOURCES/gpgkey-C2839ECAD9408FBE9531C3E9F434A1EFAFEEAEA3.gpg.asc b/SOURCES/gpgkey-C2839ECAD9408FBE9531C3E9F434A1EFAFEEAEA3.gpg.asc new file mode 100644 index 0000000..5f4f64d --- /dev/null +++ b/SOURCES/gpgkey-C2839ECAD9408FBE9531C3E9F434A1EFAFEEAEA3.gpg.asc @@ -0,0 +1,51 @@ +-----BEGIN PGP PUBLIC KEY BLOCK----- + +mQINBEyzEr0BEADT441wUITsTwDA2nM3kmUhGrzTdxZB5xv/E1ZJCw63qWdmdTdW +NZDfNDuLs4r2VjlEoA3xGK6jgnQvyAoNj0yiEbW/JedHHgOiVdXDlkgkY58myafT +FXqDLzTXVrsNnay0GS8XrNjptZJPhEPBvNUdkqpA9B7RTkfaXj779Pf/AeFMZVLl +UAci5RA0NNF910GHwoXT6SEv2PGoawsphnfmMVdKh9wz7asbtKXEmotCwX3k045x +LsIVK5ANOi+BI9C3LkrrFJWw2XHqDW2ulwCJ0L5QNSjOuY/v8REODwIXamvvdZOz +XBKSIzDOalJqFCHls3YlGyFw1knr6BAOmVOm32YtNTCLbVA/iK55fZWnUCjD3a4G +xz4qpQYWfpxhOmlHpk5JkraSNHzCc7SB43DwcHF5ecXHttMhO8MoN/bAZBgCuLGF +EwNvwFbDwIWo07mlv7wD8i1rtUCvLywJc5YL2PbjCLfB1Q4YzDX1EWnjKdnAsxxK +ftrx1DFlxzUF+TaHbLTPttUcsWQaL8wITznoWIwdIWlo2woPgWIpUXMOYwYV31Oo +fgmroHa3V4NOvkke09uhaZawg5yZCoRFohhfKPqT1ZrJ9SnRbW/WR3VTVY76ht5k +RuV3eb2VWBmPU9zn56Tbe6dvFkBuzHH1JdECAqy1BzFcmQQFBebFzf1XAQARAQAB +tEhMaWJyZU9mZmljZSBCdWlsZCBUZWFtIChDT0RFIFNJR05JTkcgS0VZKSA8YnVp +bGRAZG9jdW1lbnRmb3VuZGF0aW9uLm9yZz6JAjcEEwEKACEFAkyzEr0CGwMFCwkI +BwMFFQoJCAsFFgIDAQACHgECF4AACgkQ9DSh76/urqOc4w//X+74QlyRalcuLNw3 +oJKB1+1z6xxhhpwg1kw5cMMrGu0w0YoPvLDKaiS02DdkIaXDECcQTOoEh7/bYbZq +6OtE1WyxqHYYOPK5yul5FRwZ5k5HZ7pDFcKCQ72UgWhz+QznRhgZ0jwEWl5Ln3rw +JpSynIvTXHmQogId0xmcrNQPyckzzugGx4qZFinSOmDGwTgG14NU3vat2iek37Ph +BLh5V8ohlEoccwwPejtKEWQudg0Q8K7uBuqLUhnJoZodEytqpOvtysuPtGxGXnmD +7oXtBVEF3X6eFRXDIp81cx2isHK4Krf4z4T9KUimNLHjWRa+ZQtp2pZLHQlblfsn +CUf6TYZ0Yi909EhcM/hxAgBZXellOCQ/8U2cJsTUyN5Dp1wbf6X0uK4uaed1/037 +EGLAO6PP6WQz6jWd1/hhsQ5oAmdjkzlMFEfKNeIIDuKMOjXcTvM8/KRXhufwICvS +FBlSIveHfDFWCvOVgq0VjAY7NFMFKRUnRHB58qBamtyhOyscRIvT5QH8HYfUA/YN +l9FguczYUIQi3t+H1hoHIywdtmRuhYx5WlIUe8FO9QD5RMPbBjVbkCYgdHdxgnJD +KCoRGsoKlLB7UZc4Ak9j6plZbYtFRonm2MjU4zxblCFNuEqVQ0V/y6/OIGpBYF9Y +aEAtTgEJd9OmmDCM3d8O0zZHYma5Ag0ETLMSvQEQAMDp0HxSDWd+2Od/aJutCMFe +8tfw7+nP9gfHOCUqesb88QvRMJgVY6z1aNdMllxTKlsxUiuA6uNcrUAkzDp/qRWR +58rWIO642PLifng3urJ1cDbSKC+K4RHpQC+hXllMKLqq8dwNy1LO4fPo9SdtUF4B +ev6enKmo4yCiOGv2tvztPh9gMGYoDncaOsS0t2UPr2MMQIVUmmIzfJBkdOxbZiWO +doeNbWsYJHQaO+Ahal6SjPHKzhdjeXhZzHl1vqeDkV4MXHprrOwXNXwPiEpkZe2O +dc7yaMkQc0k8WRrfKHApbnwDx6Mi8HYaf+LvRq7P0eMO9osD1q44wQQvVzk199zp +MMHS5/kAv7RBNmDOSJQIZ4zT4lzRDODjMf01Ljn02zon12GfJo0WbbpmLulta7uj +HgMrUU54by8WPFGW0fljXiDX0EpkHhxUsUsfaNfBsFnE+sRxQjNF/ljvofkyApI2 +1OjtEa9krwvgDqaXsL+a2076OsoFpORlTZ30REb0eRS6rEt8M+7s4xTaA7GFxlY/ +N+bnaM8m+ItygfFHHW4H0wLbbgajDeooSTgaheVNF5V9HS0EkN4MNVvtJH7J6drd +iR1QVhX87n7+JtQzTtCOyfeKjaB+kcbAm/2VOFOeHdig5+BygpXt3IixVq72xmGz +h0jhY565MjXrqg5O3pvLABEBAAGJAh8EGAEKAAkFAkyzEr0CGwwACgkQ9DSh76/u +rqPaeg//avI2/a94XlSYtSZb2hVdW3qa9AEypQurqtVrKJfEKFV+ZQBPXbPRy8Mz +5LMEH1sfD6B4SVGIGJ8opSyieJkcKIke+GMekTWvSqDpFOgY2rw7eHNn/33ZJs3O +zQOyWz8smE/AIM/5lyiVGuSlU7RjYncf1V9bIBc91q9Edqk4IYUo/7W+yafC0VW/ +8oHUFYjHNaujiOsEoLiXsh9Y0R/6Jxs6fvE4XbCANV/ecN5UX+9BBrNZNN/9GbNr +6CYGZ57M2f1Pgywy/XvOnEPnJ8aWXUyGLqq34KvMPFPSOeAmFbkFEsB4mdDMFaDw +rzziiZE/zS8/nKiH4X2JgmLgFsadEihdfYxeDcGbhREK/qA1f3bGnr1j05V07yko +2FFZdiOr4OgiT5ymgwVUXQ2Aiz+J/C8URjfpcPxetmuDQT9AYfgmMKPNVXPFWuNQ +dzN5GZbI+E1/cb5+uLNknvjngw2G4PR/4uPHX1HCSftlNawBqWzyun1k+B7/u3Oe +FebWXcdqSmZuLQ7l0Pkuz/Nlp6M6cKpceL+9zCgaiR5+v9h94VvtXKd/mw9ZLACc +VcOANiwCtsJP3lt7jRSHtkuUe6vUm5tLS582RfXxoI1BlPjNtG9xAQ3JKBHIXbal +T18pAFO3t74cxg3h0iI1G51F3oL0DwILP2MBBmardVEp5CMnB/M= +=1iQB +-----END PGP PUBLIC KEY BLOCK----- diff --git a/SOURCES/libreoffice-base-symbolic.svg b/SOURCES/libreoffice-base-symbolic.svg new file mode 100644 index 0000000..16f3cef --- /dev/null +++ b/SOURCES/libreoffice-base-symbolic.svg @@ -0,0 +1,27 @@ + + + + + + + + image/svg+xml + + Gnome Symbolic Icon Theme + + + + + + + Gnome Symbolic Icon Theme + + + + + + + + + + diff --git a/SOURCES/libreoffice-calc-symbolic.svg b/SOURCES/libreoffice-calc-symbolic.svg new file mode 100644 index 0000000..bf56588 --- /dev/null +++ b/SOURCES/libreoffice-calc-symbolic.svg @@ -0,0 +1,27 @@ + + + + + + + + image/svg+xml + + Gnome Symbolic Icon Theme + + + + + + + Gnome Symbolic Icon Theme + + + + + + + + + + diff --git a/SOURCES/libreoffice-draw-symbolic.svg b/SOURCES/libreoffice-draw-symbolic.svg new file mode 100644 index 0000000..7ca94ee --- /dev/null +++ b/SOURCES/libreoffice-draw-symbolic.svg @@ -0,0 +1,26 @@ + + + + + + + + image/svg+xml + + Gnome Symbolic Icon Theme + + + + + + + Gnome Symbolic Icon Theme + + + + + + + + + diff --git a/SOURCES/libreoffice-impress-symbolic.svg b/SOURCES/libreoffice-impress-symbolic.svg new file mode 100644 index 0000000..9a16f76 --- /dev/null +++ b/SOURCES/libreoffice-impress-symbolic.svg @@ -0,0 +1,25 @@ + + + + + + + + image/svg+xml + + Gnome Symbolic Icon Theme + + + + + + + Gnome Symbolic Icon Theme + + + + + + + + diff --git a/SOURCES/libreoffice-main-symbolic.svg b/SOURCES/libreoffice-main-symbolic.svg new file mode 100644 index 0000000..6bd3103 --- /dev/null +++ b/SOURCES/libreoffice-main-symbolic.svg @@ -0,0 +1,24 @@ + + + + + + + + image/svg+xml + + Gnome Symbolic Icon Theme + + + + + + + Gnome Symbolic Icon Theme + + + + + + + diff --git a/SOURCES/libreoffice-math-symbolic.svg b/SOURCES/libreoffice-math-symbolic.svg new file mode 100644 index 0000000..66cd9e7 --- /dev/null +++ b/SOURCES/libreoffice-math-symbolic.svg @@ -0,0 +1,25 @@ + + + + + + + + image/svg+xml + + Gnome Symbolic Icon Theme + + + + + + + Gnome Symbolic Icon Theme + + + + + + + + diff --git a/SOURCES/libreoffice-writer-symbolic.svg b/SOURCES/libreoffice-writer-symbolic.svg new file mode 100644 index 0000000..e97b545 --- /dev/null +++ b/SOURCES/libreoffice-writer-symbolic.svg @@ -0,0 +1,28 @@ + + + + + + + + image/svg+xml + + Gnome Symbolic Icon Theme + + + + + + + Gnome Symbolic Icon Theme + + + + + + + + + + + diff --git a/SPECS/libreoffice.spec b/SPECS/libreoffice.spec index 43ddf80..7d0a58d 100644 --- a/SPECS/libreoffice.spec +++ b/SPECS/libreoffice.spec @@ -54,7 +54,7 @@ Summary: Free Software Productivity Suite Name: libreoffice Epoch: 1 Version: %{libo_version}.2 -Release: 17%{?libo_prerelease}%{?dist}.alma.1 +Release: 18%{?libo_prerelease}%{?dist}.alma.1 License: (MPLv1.1 or LGPLv3+) and LGPLv3 and LGPLv2+ and BSD and (MPLv1.1 or GPLv2 or LGPLv2 or Netscape) and Public Domain and ASL 2.0 and MPLv2.0 and CC0 URL: http://www.libreoffice.org/ @@ -293,7 +293,6 @@ Patch49: 0001-set-Referer-on-loading-IFrames.patch Patch50: 0002-put-floating-frames-under-managed-links-control.patch Patch51: 0003-assume-IFrame-script-macro-support-isn-t-needed.patch Patch52: 0001-disable-script-dump.patch -# Patches were taken from the latest OL release Patch53: 0001-CVE-2023-6185-escape-url-passed-to-gstreamer.patch Patch54: 0001-CVE-2023-6186-add-some-protocols-that-don-t-make-sense-as-floating.patch Patch55: 0002-CVE-2023-6186-warn-about-exotic-protocols-as-well.patch @@ -301,8 +300,8 @@ Patch56: 0003-CVE-2023-6186-default-to-ignoring-libreoffice-special-purpose-prot Patch57: 0004-CVE-2023-6186-reuse-AllowedLinkProtocolFromDocument-in-writer.patch Patch58: 0005-CVE-2023-6186-reuse-AllowedLinkProtocolFromDocument-in-impress-dra.patch Patch59: 0006-CVE-2023-6186-backporting.patch -# https://gitlab.com/redhat/centos-stream/rpms/libreoffice/-/commit/95b2641468a862d1c14510ba087ccdceab80951b Patch60: 0001-CVE-2024-3044-add-notify-for-script-use.patch +Patch61: 0001-CVE-2024-6472-remove-ability-to-trust-not-validated-macro-signatur.patch %if 0%{?rhel} # not upstreamed @@ -2298,19 +2297,15 @@ done %{_includedir}/LibreOfficeKit %changelog -* Wed Jul 03 2024 Eduard Abdullin - 1:6.4.7.2-17.alma.1 -- CVE-2024-3044 add notify for script use +* Tue Aug 20 2024 Eduard Abdullin - 1:6.4.7.2-18.alma.1 +- Debrand for AlmaLinux -* Fri Mar 29 2024 Eduard Abdullin - 1:6.4.7.2-16.alma.1 -- escape url passed to gstreamer -- add some protocols that don't make sense as floating frame - targets -- warn about exotic protocols as well -- default to ignoring libreoffice special-purpose protocols - in calc hyperlink -- reuse AllowedLinkProtocolFromDocument in writer -- reuse AllowedLinkProtocolFromDocument in impress/draw -- CVE-2023-6186 backporting +* Thu Aug 15 2024 Eike Rathke - 1:6.4.7.2-18 +- Fix CVE-2024-6472 remove ability to trust not validated macro signatures in + high security + +* Fri Jun 07 2024 Eike Rathke - 1:6.4.7.2-17 +- Fix CVE-2024-3044 add notify for script use * Mon Mar 11 2024 Eike Rathke - 1:6.4.7.2-16 - Fix CVE-2023-6185 escape url passed to gstreamer