LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document-open etc. Access is intended to be restricted to scripts under the share/Scripts/python, user/Scripts/python sub-directories of the LibreOffice install. Protection was added, to address CVE-2018-16858, to avoid a directory traversal attack where scripts in arbitrary locations on the file system could be executed. However this new protection could be bypassed by a URL encoding attack. In the fixed versions, the parsed url describing the script location is correctly encoded before further processing. This issue affects: Document Foundation LibreOffice versions prior to 6.2.6.
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "2:102.7+LibO5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "fonts-opensymbol" }, { "binary_version": "1:5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "gir1.2-lokdocview-0.1" }, { "binary_version": "1:5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "gir1.2-lokdocview-0.1-dbgsym" }, { "binary_version": "1:5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "libreoffice" }, { "binary_version": "1:5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "libreoffice-avmedia-backend-gstreamer" }, { "binary_version": "1:5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "libreoffice-avmedia-backend-gstreamer-dbgsym" }, { "binary_version": "1:5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "libreoffice-base" }, { "binary_version": "1:5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "libreoffice-base-core" }, { "binary_version": "1:5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "libreoffice-base-core-dbgsym" }, { "binary_version": "1:5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "libreoffice-base-dbgsym" }, { "binary_version": "1:5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "libreoffice-base-drivers" }, { "binary_version": "1:5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "libreoffice-base-drivers-dbgsym" }, { "binary_version": "1:5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "libreoffice-calc" }, { "binary_version": "1:5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "libreoffice-calc-dbgsym" }, { "binary_version": "1:5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "libreoffice-common" }, { "binary_version": "1:5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "libreoffice-core" }, { "binary_version": "1:5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "libreoffice-core-dbgsym" }, { "binary_version": "1:5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "libreoffice-dbg" }, { "binary_version": "1:5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "libreoffice-dbgsym" }, { "binary_version": "1:5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "libreoffice-dev" }, { "binary_version": "1:5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "libreoffice-dev-dbgsym" }, { "binary_version": "1:5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "libreoffice-dev-doc" }, { "binary_version": "1:5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "libreoffice-draw" }, { "binary_version": "1:5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "libreoffice-draw-dbgsym" }, { "binary_version": "1:5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "libreoffice-gnome" }, { "binary_version": "1:5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "libreoffice-gnome-dbgsym" }, { "binary_version": "1:5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "libreoffice-gtk" }, { "binary_version": "1:5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "libreoffice-gtk-dbgsym" }, { "binary_version": "1:5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "libreoffice-gtk3" }, { "binary_version": "1:5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "libreoffice-gtk3-dbgsym" }, { "binary_version": "1:5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "libreoffice-impress" }, { "binary_version": "1:5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "libreoffice-impress-dbgsym" }, { "binary_version": "1:5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "libreoffice-java-common" }, { "binary_version": "1:5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "libreoffice-kde" }, { "binary_version": "1:5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "libreoffice-kde-dbgsym" }, { "binary_version": "1:5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "libreoffice-l10n-in" }, { "binary_version": "1:5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "libreoffice-l10n-za" }, { "binary_version": "1:5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "libreoffice-librelogo" }, { "binary_version": "1:5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "libreoffice-math" }, { "binary_version": "1:5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "libreoffice-math-dbgsym" }, { "binary_version": "1.0.2+LibO5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "libreoffice-mysql-connector" }, { "binary_version": "1.0.2+LibO5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "libreoffice-mysql-connector-dbgsym" }, { "binary_version": "1:5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "libreoffice-officebean" }, { "binary_version": "1:5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "libreoffice-officebean-dbgsym" }, { "binary_version": "1:5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "libreoffice-ogltrans" }, { "binary_version": "1:5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "libreoffice-ogltrans-dbgsym" }, { "binary_version": "1:5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "libreoffice-pdfimport" }, { "binary_version": "1:5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "libreoffice-pdfimport-dbgsym" }, { "binary_version": "1:5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "libreoffice-report-builder" }, { "binary_version": "1:5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "libreoffice-report-builder-bin" }, { "binary_version": "1:5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "libreoffice-report-builder-bin-dbgsym" }, { "binary_version": "1:5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "libreoffice-script-provider-bsh" }, { "binary_version": "1:5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "libreoffice-script-provider-js" }, { "binary_version": "1:5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "libreoffice-script-provider-python" }, { "binary_version": "1:5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "libreoffice-sdbc-firebird" }, { "binary_version": "1:5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "libreoffice-sdbc-firebird-dbgsym" }, { "binary_version": "1:5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "libreoffice-sdbc-hsqldb" }, { "binary_version": "1:5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "libreoffice-sdbc-hsqldb-dbgsym" }, { "binary_version": "1:5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "libreoffice-sdbc-postgresql" }, { "binary_version": "1:5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "libreoffice-sdbc-postgresql-dbgsym" }, { "binary_version": "1:5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "libreoffice-style-breeze" }, { "binary_version": "1:5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "libreoffice-style-elementary" }, { "binary_version": "1:5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "libreoffice-style-galaxy" }, { "binary_version": "1:5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "libreoffice-style-hicontrast" }, { "binary_version": "1:5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "libreoffice-style-human" }, { "binary_version": "1:5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "libreoffice-style-oxygen" }, { "binary_version": "1:5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "libreoffice-style-sifr" }, { "binary_version": "1:5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "libreoffice-style-tango" }, { "binary_version": "1:5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "libreoffice-subsequentcheckbase" }, { "binary_version": "1.2.0+LibO5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "libreoffice-wiki-publisher" }, { "binary_version": "1:5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "libreoffice-writer" }, { "binary_version": "1:5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "libreoffice-writer-dbgsym" }, { "binary_version": "1:5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "libreofficekit-dev" }, { "binary_version": "1:5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "python3-uno" }, { "binary_version": "5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "uno-libs3" }, { "binary_version": "5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "uno-libs3-dbg" }, { "binary_version": "5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "uno-libs3-dbgsym" }, { "binary_version": "5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "ure" }, { "binary_version": "5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "ure-dbg" }, { "binary_version": "5.1.6~rc2-0ubuntu1~xenial9", "binary_name": "ure-dbgsym" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "2:102.10+LibO6.0.7-0ubuntu0.18.04.9", "binary_name": "fonts-opensymbol" }, { "binary_version": "1:6.0.7-0ubuntu0.18.04.9", "binary_name": "gir1.2-lokdocview-0.1" }, { "binary_version": "1:6.0.7-0ubuntu0.18.04.9", "binary_name": "liblibreofficekitgtk" }, { "binary_version": "1:6.0.7-0ubuntu0.18.04.9", "binary_name": "liblibreofficekitgtk-dbgsym" }, { "binary_version": "1:6.0.7-0ubuntu0.18.04.9", "binary_name": "libreoffice" }, { "binary_version": "1:6.0.7-0ubuntu0.18.04.9", "binary_name": "libreoffice-avmedia-backend-gstreamer" }, { "binary_version": "1:6.0.7-0ubuntu0.18.04.9", "binary_name": "libreoffice-avmedia-backend-gstreamer-dbgsym" }, { "binary_version": "1:6.0.7-0ubuntu0.18.04.9", "binary_name": "libreoffice-base" }, { "binary_version": "1:6.0.7-0ubuntu0.18.04.9", "binary_name": "libreoffice-base-core" }, { "binary_version": "1:6.0.7-0ubuntu0.18.04.9", "binary_name": "libreoffice-base-core-dbgsym" }, { "binary_version": "1:6.0.7-0ubuntu0.18.04.9", "binary_name": "libreoffice-base-dbgsym" }, { "binary_version": "1:6.0.7-0ubuntu0.18.04.9", "binary_name": "libreoffice-base-drivers" }, { "binary_version": "1:6.0.7-0ubuntu0.18.04.9", "binary_name": "libreoffice-base-drivers-dbgsym" }, { "binary_version": "1:6.0.7-0ubuntu0.18.04.9", "binary_name": "libreoffice-calc" }, { "binary_version": "1:6.0.7-0ubuntu0.18.04.9", "binary_name": "libreoffice-calc-dbgsym" }, { "binary_version": "1:6.0.7-0ubuntu0.18.04.9", "binary_name": "libreoffice-common" }, { "binary_version": "1:6.0.7-0ubuntu0.18.04.9", "binary_name": "libreoffice-core" }, { "binary_version": "1:6.0.7-0ubuntu0.18.04.9", "binary_name": "libreoffice-core-dbgsym" }, { "binary_version": "1:6.0.7-0ubuntu0.18.04.9", "binary_name": "libreoffice-dev" }, { "binary_version": "1:6.0.7-0ubuntu0.18.04.9", "binary_name": "libreoffice-dev-common" }, { "binary_version": "1:6.0.7-0ubuntu0.18.04.9", "binary_name": "libreoffice-dev-dbgsym" }, { "binary_version": "1:6.0.7-0ubuntu0.18.04.9", "binary_name": "libreoffice-dev-doc" }, { "binary_version": "1:6.0.7-0ubuntu0.18.04.9", "binary_name": "libreoffice-draw" }, { "binary_version": "1:6.0.7-0ubuntu0.18.04.9", "binary_name": "libreoffice-draw-dbgsym" }, { "binary_version": "1:6.0.7-0ubuntu0.18.04.9", "binary_name": "libreoffice-evolution" }, { "binary_version": "1:6.0.7-0ubuntu0.18.04.9", "binary_name": "libreoffice-evolution-dbgsym" }, { "binary_version": "1:6.0.7-0ubuntu0.18.04.9", "binary_name": "libreoffice-gnome" }, { "binary_version": "1:6.0.7-0ubuntu0.18.04.9", "binary_name": "libreoffice-gnome-dbgsym" }, { "binary_version": "1:6.0.7-0ubuntu0.18.04.9", "binary_name": "libreoffice-gtk" }, { "binary_version": "1:6.0.7-0ubuntu0.18.04.9", "binary_name": "libreoffice-gtk2" }, { "binary_version": "1:6.0.7-0ubuntu0.18.04.9", "binary_name": "libreoffice-gtk2-dbgsym" }, { "binary_version": "1:6.0.7-0ubuntu0.18.04.9", "binary_name": "libreoffice-gtk3" }, { "binary_version": "1:6.0.7-0ubuntu0.18.04.9", "binary_name": "libreoffice-gtk3-dbgsym" }, { "binary_version": "1:6.0.7-0ubuntu0.18.04.9", "binary_name": "libreoffice-impress" }, { "binary_version": "1:6.0.7-0ubuntu0.18.04.9", "binary_name": "libreoffice-impress-dbgsym" }, { "binary_version": "1:6.0.7-0ubuntu0.18.04.9", "binary_name": "libreoffice-java-common" }, { "binary_version": "1:6.0.7-0ubuntu0.18.04.9", "binary_name": "libreoffice-kde" }, { "binary_version": "1:6.0.7-0ubuntu0.18.04.9", "binary_name": "libreoffice-kde4" }, { "binary_version": "1:6.0.7-0ubuntu0.18.04.9", "binary_name": "libreoffice-kde4-dbgsym" }, { "binary_version": "1:6.0.7-0ubuntu0.18.04.9", "binary_name": "libreoffice-l10n-in" }, { "binary_version": "1:6.0.7-0ubuntu0.18.04.9", "binary_name": "libreoffice-l10n-za" }, { "binary_version": "1:6.0.7-0ubuntu0.18.04.9", "binary_name": "libreoffice-librelogo" }, { "binary_version": "1:6.0.7-0ubuntu0.18.04.9", "binary_name": "libreoffice-math" }, { "binary_version": "1:6.0.7-0ubuntu0.18.04.9", "binary_name": "libreoffice-math-dbgsym" }, { "binary_version": "1.0.2+LibO6.0.7-0ubuntu0.18.04.9", "binary_name": "libreoffice-mysql-connector" }, { "binary_version": "1.0.2+LibO6.0.7-0ubuntu0.18.04.9", "binary_name": "libreoffice-mysql-connector-dbgsym" }, { "binary_version": "0.9+LibO6.0.7-0ubuntu0.18.04.9", "binary_name": "libreoffice-nlpsolver" }, { "binary_version": "1:6.0.7-0ubuntu0.18.04.9", "binary_name": "libreoffice-officebean" }, { "binary_version": "1:6.0.7-0ubuntu0.18.04.9", "binary_name": "libreoffice-officebean-dbgsym" }, { "binary_version": "1:6.0.7-0ubuntu0.18.04.9", "binary_name": "libreoffice-ogltrans" }, { "binary_version": "1:6.0.7-0ubuntu0.18.04.9", "binary_name": "libreoffice-ogltrans-dbgsym" }, { "binary_version": "1:6.0.7-0ubuntu0.18.04.9", "binary_name": "libreoffice-pdfimport" }, { "binary_version": "1:6.0.7-0ubuntu0.18.04.9", "binary_name": "libreoffice-report-builder" }, { "binary_version": "1:6.0.7-0ubuntu0.18.04.9", "binary_name": "libreoffice-report-builder-bin" }, { "binary_version": "1:6.0.7-0ubuntu0.18.04.9", "binary_name": "libreoffice-report-builder-bin-dbgsym" }, { "binary_version": "1:6.0.7-0ubuntu0.18.04.9", "binary_name": "libreoffice-script-provider-bsh" }, { "binary_version": "1:6.0.7-0ubuntu0.18.04.9", "binary_name": "libreoffice-script-provider-js" }, { "binary_version": "1:6.0.7-0ubuntu0.18.04.9", "binary_name": "libreoffice-script-provider-python" }, { "binary_version": "1:6.0.7-0ubuntu0.18.04.9", "binary_name": "libreoffice-sdbc-firebird" }, { "binary_version": "1:6.0.7-0ubuntu0.18.04.9", "binary_name": "libreoffice-sdbc-firebird-dbgsym" }, { "binary_version": "1:6.0.7-0ubuntu0.18.04.9", "binary_name": "libreoffice-sdbc-hsqldb" }, { "binary_version": "1:6.0.7-0ubuntu0.18.04.9", "binary_name": "libreoffice-sdbc-hsqldb-dbgsym" }, { "binary_version": "1:6.0.7-0ubuntu0.18.04.9", "binary_name": "libreoffice-sdbc-postgresql" }, { "binary_version": "1:6.0.7-0ubuntu0.18.04.9", "binary_name": "libreoffice-sdbc-postgresql-dbgsym" }, { "binary_version": "1:6.0.7-0ubuntu0.18.04.9", "binary_name": "libreoffice-style-breeze" }, { "binary_version": "1:6.0.7-0ubuntu0.18.04.9", "binary_name": "libreoffice-style-elementary" }, { "binary_version": "1:6.0.7-0ubuntu0.18.04.9", "binary_name": "libreoffice-style-galaxy" }, { "binary_version": "1:6.0.7-0ubuntu0.18.04.9", "binary_name": "libreoffice-style-hicontrast" }, { "binary_version": "1:6.0.7-0ubuntu0.18.04.9", "binary_name": "libreoffice-style-human" }, { "binary_version": "1:6.0.7-0ubuntu0.18.04.9", "binary_name": "libreoffice-style-oxygen" }, { "binary_version": "1:6.0.7-0ubuntu0.18.04.9", "binary_name": "libreoffice-style-sifr" }, { "binary_version": "1:6.0.7-0ubuntu0.18.04.9", "binary_name": "libreoffice-style-tango" }, { "binary_version": "1:6.0.7-0ubuntu0.18.04.9", "binary_name": "libreoffice-subsequentcheckbase" }, { "binary_version": "1:6.0.7-0ubuntu0.18.04.9", "binary_name": "libreoffice-systray" }, { "binary_version": "1:6.0.7-0ubuntu0.18.04.9", "binary_name": "libreoffice-systray-dbgsym" }, { "binary_version": "1.2.0+LibO6.0.7-0ubuntu0.18.04.9", "binary_name": "libreoffice-wiki-publisher" }, { "binary_version": "1:6.0.7-0ubuntu0.18.04.9", "binary_name": "libreoffice-writer" }, { "binary_version": "1:6.0.7-0ubuntu0.18.04.9", "binary_name": "libreoffice-writer-dbgsym" }, { "binary_version": "1:6.0.7-0ubuntu0.18.04.9", "binary_name": "libreofficekit-data" }, { "binary_version": "1:6.0.7-0ubuntu0.18.04.9", "binary_name": "libreofficekit-dev" }, { "binary_version": "1:6.0.7-0ubuntu0.18.04.9", "binary_name": "python3-uno" }, { "binary_version": "1:6.0.7-0ubuntu0.18.04.9", "binary_name": "python3-uno-dbgsym" }, { "binary_version": "6.0.7-0ubuntu0.18.04.9", "binary_name": "uno-libs3" }, { "binary_version": "6.0.7-0ubuntu0.18.04.9", "binary_name": "uno-libs3-dbgsym" }, { "binary_version": "6.0.7-0ubuntu0.18.04.9", "binary_name": "ure" }, { "binary_version": "6.0.7-0ubuntu0.18.04.9", "binary_name": "ure-dbgsym" } ] }