[ubuntu/noble-updates] libreoffice 4:24.2.7-0ubuntu0.24.04.2 (Accepted)

[Ubuntu Archive Robot]

libreoffice (4:24.2.7-0ubuntu0.24.04.2) noble-security; urgency=medium

  * SECURITY UPDATE: Path traversal leading to arbitrary .ttf file write
    - debian/patches/CVE-2024-12425.patch: be conservative on allowed temp
      font names
    - CVE-2024-12425
  * SECURITY UPDATE: URL fetching can be used to exfiltrate arbitrary INI
      file values and environment variables
    - debian/patches/CVE-2024-12426-1.patch: consider VndSunStarExpand an
      exotic protocol
    - debian/patches/CVE-2024-12426-2.patch: look at 'embedded' protocols too
    - debian/patches/CVE-2024-12426-3.patch: Fix check for further exotic
      protocols
    - CVE-2024-12426

Date: 2025-01-24 14:15:55.884455+00:00
Changed-By: Rico Tzschichholz <ricotz at web.de>
Signed-By: Ubuntu Archive Robot <ubuntu-archive-robot at lists.canonical.com>
https://launchpad.net/ubuntu/+source/libreoffice/4:24.2.7-0ubuntu0.24.04.2
-------------- next part --------------
Sorry, changesfile not available.