import Oracle_OSS libreoffice-7.1.8.1-15.0.1.el9_8.1

SOURCES/0001-CVE-2026-4430-Conform-AlignEngine-parsing.patch

@@ -0,0 +1,46 @@
+From 1ec3db717fa144ddff3e9b0a2338a82355cf365b Mon Sep 17 00:00:00 2001
+From: Caolán McNamara <caolan.mcnamara@collabora.com>
+Date: Mon, 16 Mar 2026 17:22:23 +0000
+Subject: [PATCH] Conform AlignEngine parsing to what section 2.3.4.10 of the spec has
+
+Change-Id: Ibb9162b1ce7993ef74665ec0329c95b423fa8174
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/201874
+Tested-by: Jenkins
+Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
+---
+
+diff -up libreoffice-7.1.8.1/oox/source/crypto/AgileEngine.cxx.cve-2026-4430 libreoffice-7.1.8.1/oox/source/crypto/AgileEngine.cxx
+--- libreoffice-7.1.8.1/oox/source/crypto/AgileEngine.cxx.cve-2026-4430	2021-12-03 22:40:28.000000000 +0100
++++ libreoffice-7.1.8.1/oox/source/crypto/AgileEngine.cxx	2026-05-18 08:51:46.431152626 +0200
+@@ -8,6 +8,8 @@
+  *
+  */
+ 
++#include <o3tl/safeint.hxx>
++#include <sal/log.hxx>
+ #include <oox/crypto/AgileEngine.hxx>
+ 
+ #include <oox/helper/binaryinputstream.hxx>
+@@ -532,8 +534,21 @@ bool AgileEngine::readEncryptionInfo(uno
+     if (0 > mInfo.spinCount || mInfo.spinCount > 10000000)
+         return false;
+ 
+-    if (1 > mInfo.saltSize|| mInfo.saltSize > 65536) // Check
++    // [MS-OFFCRYPTO] 2.3.4.10: saltSize "MUST be at least 1 and no greater than 65,536"
++    if (1 > mInfo.saltSize || mInfo.saltSize > 65536)
++    {
++        SAL_WARN("oox", "AgileEngine::readEncryptionInfo(): saltSize out of range: " << mInfo.saltSize);
++        return false;
++    }
++
++    // [MS-OFFCRYPTO] 2.3.4.10: "The number of bytes required to decode the saltValue
++    // attribute MUST be equal to the value of the saltSize attribute"
++    if (mInfo.keyDataSalt.size() != o3tl::make_unsigned(mInfo.saltSize))
++    {
++        SAL_WARN("oox", "AgileEngine::readEncryptionInfo(): keyDataSalt size " << mInfo.keyDataSalt.size()
++                 << " does not match saltSize " << mInfo.saltSize);
+         return false;
++    }
+ 
+     // AES 128 CBC with SHA1
+     if (mInfo.keyBits         == 128 &&

SPECS/libreoffice.spec

@@ -1,3 +1,8 @@
+# RHEL-9.* without i686, not shipped and Java mismatches
+%if 0%{?rhel} >= 9
+ExcludeArch:    %{ix86}
+%endif
+
 # download path contains version without the last (fourth) digit
 %global libo_version 7.1.8
 # Should contain .alphaX / .betaX, if this is pre-release (actually
@@ -8,7 +13,7 @@
 %global libo_buildfix %{nil}
 # rhbz#715152 state vendor
 %if 0%{?rhel}
-%global vendoroption --with-vendor="Red Hat, Inc."
+%global vendoroption --with-vendor="Oracle America, Inc."
 %endif
 %if 0%{?fedora}
 %global vendoroption --with-vendor="The Fedora Project"
@@ -57,7 +62,7 @@ Summary:        Free Software Productivity Suite
 Name:           libreoffice
 Epoch:          1
 Version:        %{libo_version}.1
-Release:        15%{?libo_prerelease}%{?dist}
+Release:        15%{?libo_prerelease}.0.1%{?dist}.1
 License:        (MPLv1.1 or LGPLv3+) and LGPLv3 and LGPLv2+ and BSD and (MPLv1.1 or GPLv2 or LGPLv2 or Netscape) and Public Domain and ASL 2.0 and MPLv2.0 and CC0
 URL:            http://www.libreoffice.org/
 
@@ -299,6 +304,8 @@ Patch43: 0006-CVE-2023-6186-backporting.patch
 Patch44: 0001-CVE-2024-3044-add-notify-for-script-use.patch
 Patch45: 0001-CVE-2024-6472-remove-ability-to-trust-not-validated-macro-signatur.patch
 Patch46: 0001-CVE-2025-1080-Filter-out-more-unwanted-command-URIs.patch
+# https://gerrit.libreoffice.org/c/core/+/202756
+Patch47: 0001-CVE-2026-4430-Conform-AlignEngine-parsing.patch
 
 # not upstreamed
 Patch500: 0001-disable-libe-book-support.patch
@@ -1038,16 +1045,24 @@ rm -rf git-hooks */git-hooks
 %global __scm git_am
 %__scm_setup_git_am
 
-#Customize Palette to add Red Hat colours
+#Customize Palette to add Oracle colours
 (head -n -1 extras/source/palettes/standard.soc && \
- echo -e '  <draw:color draw:name="Red Hat 1" draw:color="#cc0000"/>
-  <draw:color draw:name="Red Hat 2" draw:color="#0093d9"/>
-  <draw:color draw:name="Red Hat 3" draw:color="#ff8d00"/>
-  <draw:color draw:name="Red Hat 4" draw:color="#abb400"/>
-  <draw:color draw:name="Red Hat 5" draw:color="#4e376b"/>' && \
- tail -n 1 extras/source/palettes/standard.soc) > redhat.soc
-mv -f redhat.soc extras/source/palettes/standard.soc
-git commit -q -a -m 'add Red Hat colors to palette'
+echo -e '  <draw:color draw:name="Oracle Bark" draw:color="#312d2a"/>
+<draw:color draw:name="Oracle Red" draw:color="#c74634"/>
+<draw:color draw:name="Oracle secondary: Sunrise" draw:color="#facd62"/>
+<draw:color draw:name="Oracle secondary: Ember" draw:color="#ae562c"/>
+<draw:color draw:name="Oracle secondary: Fog" draw:color="#94afaf"/>
+<draw:color draw:name="Oracle secondary: Ivy" draw:color="#759c6c"/>
+<draw:color draw:name="Oracle secondary: Sand" draw:color="#e5dbbe"/>
+<draw:color draw:name="Oracle secondary: Ocean" draw:color="#2c5967"/>
+<draw:color draw:name="Oracle secondary: Surf" draw:color="#41817e"/>
+<draw:color draw:name="Oracle secondary: Forest" draw:color="#2b6242"/>
+<draw:color draw:name="Oracle neutral: Air" draw:color="#fcfbfa"/>
+<draw:color draw:name="Oracle neutral: Pebble" draw:color="#8b8580"/>
+<draw:color draw:name="Oracle neutral: Granite" draw:color="#67605b"/>'
+tail -n 1 extras/source/palettes/standard.soc) > oracle.soc
+mv -f oracle.soc extras/source/palettes/standard.soc
+git commit -q -a -m 'add Oracle colors to palette'
 
 # apply patches
 %autopatch -M 99
@@ -1163,6 +1178,7 @@ touch autogen.lastrun
  --without-export-validation \
  --without-fonts \
  --without-lxml \
+ --with-hamcrest=yes \
  --with-gdrive-client-secret="GYWrDtzyZQZ0_g5YoBCC6F0I" \
  --with-gdrive-client-id="457862564325.apps.googleusercontent.com" \
  --enable-python=system \
@@ -2302,6 +2318,15 @@ gtk-update-icon-cache -q %{_datadir}/icons/hicolor &>/dev/null || :
 %{_includedir}/LibreOfficeKit
 
 %changelog
+* Mon Jun 29 2026 Darren Archibald <darren.archibald@oracle.com> - 1:7.1.8.1-15.0.1.el9_8.1
+- Added the --with-hamcrest option to configure.
+- Replace colors with Oracle colors [Orabug: 32120093]
+
+* Tue May 19 2026 Tomas Popela <tpopela@redhat.com> - 1:7.1.8.1-15.el9_8.1
+- Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of
+  the spec has
+- Resolves: RHEL-176576
+
 * Mon Mar 10 2025 Eike Rathke <erack@redhat.com> - 1:7.1.8.1-15
 - Fix CVE-2025-1080 Filter out more unwanted command URIs