Oracle Linux: CVE-2022-26305: ELSA-2023-0089: libreoffice security update (MODERATE) (Multiple Advisories)
7
(AV:N/AC:H/Au:S/C:C/I:C/A:C)
07/25/2022
01/20/2023
01/18/2023
11/22/2024
Description
An Improper Certificate Validation vulnerability in LibreOffice existed where determining if a macro was signed by a trusted author was done by only matching the serial number and issuer string of the used certificate with that of a trusted certificate. This is not sufficient to verify that the macro was actually signed with the certificate. An adversary could therefore create an arbitrary certificate with a serial number and an issuer string identical to a trusted certificate which LibreOffice would present as belonging to the trusted author, potentially leading to the user to execute arbitrary code contained in macros improperly trusted. This issue affects: The Document Foundation LibreOffice 7.2 versions prior to 7.2.7; 7.3 versions prior to 7.3.1. An Improper Certificate Validation vulnerability was found in LibreOffice, where determining if a trusted author signed a macro was done by only matching the serial number and issuer string of the used certificate with that of a trusted certificate. This is not sufficient to verify that the macro was actually signed with the certificate. This flaw allows an adversary to create an arbitrary certificate with a serial number and an issuer string identical to a trusted certificate which LibreOffice would present as belonging to the trusted author, potentially leading to the user executing arbitrary code contained in the improperly trusted macros.
Solution(s)
- oracle-linux-upgrade-autocorr-af
- oracle-linux-upgrade-autocorr-bg
- oracle-linux-upgrade-autocorr-ca
- oracle-linux-upgrade-autocorr-cs
- oracle-linux-upgrade-autocorr-da
- oracle-linux-upgrade-autocorr-de
- oracle-linux-upgrade-autocorr-en
- oracle-linux-upgrade-autocorr-es
- oracle-linux-upgrade-autocorr-fa
- oracle-linux-upgrade-autocorr-fi
- oracle-linux-upgrade-autocorr-fr
- oracle-linux-upgrade-autocorr-ga
- oracle-linux-upgrade-autocorr-hr
- oracle-linux-upgrade-autocorr-hu
- oracle-linux-upgrade-autocorr-is
- oracle-linux-upgrade-autocorr-it
- oracle-linux-upgrade-autocorr-ja
- oracle-linux-upgrade-autocorr-ko
- oracle-linux-upgrade-autocorr-lb
- oracle-linux-upgrade-autocorr-lt
- oracle-linux-upgrade-autocorr-mn
- oracle-linux-upgrade-autocorr-nl
- oracle-linux-upgrade-autocorr-pl
- oracle-linux-upgrade-autocorr-pt
- oracle-linux-upgrade-autocorr-ro
- oracle-linux-upgrade-autocorr-ru
- oracle-linux-upgrade-autocorr-sk
- oracle-linux-upgrade-autocorr-sl
- oracle-linux-upgrade-autocorr-sr
- oracle-linux-upgrade-autocorr-sv
- oracle-linux-upgrade-autocorr-tr
- oracle-linux-upgrade-autocorr-vi
- oracle-linux-upgrade-autocorr-zh
- oracle-linux-upgrade-libreoffice-base
- oracle-linux-upgrade-libreoffice-calc
- oracle-linux-upgrade-libreoffice-core
- oracle-linux-upgrade-libreoffice-data
- oracle-linux-upgrade-libreoffice-draw
- oracle-linux-upgrade-libreoffice-emailmerge
- oracle-linux-upgrade-libreoffice-filters
- oracle-linux-upgrade-libreoffice-gdb-debug-support
- oracle-linux-upgrade-libreoffice-graphicfilter
- oracle-linux-upgrade-libreoffice-gtk3
- oracle-linux-upgrade-libreoffice-help-ar
- oracle-linux-upgrade-libreoffice-help-bg
- oracle-linux-upgrade-libreoffice-help-bn
- oracle-linux-upgrade-libreoffice-help-ca
- oracle-linux-upgrade-libreoffice-help-cs
- oracle-linux-upgrade-libreoffice-help-da
- oracle-linux-upgrade-libreoffice-help-de
- oracle-linux-upgrade-libreoffice-help-dz
- oracle-linux-upgrade-libreoffice-help-el
- oracle-linux-upgrade-libreoffice-help-en
- oracle-linux-upgrade-libreoffice-help-es
- oracle-linux-upgrade-libreoffice-help-et
- oracle-linux-upgrade-libreoffice-help-eu
- oracle-linux-upgrade-libreoffice-help-fi
- oracle-linux-upgrade-libreoffice-help-fr
- oracle-linux-upgrade-libreoffice-help-gl
- oracle-linux-upgrade-libreoffice-help-gu
- oracle-linux-upgrade-libreoffice-help-he
- oracle-linux-upgrade-libreoffice-help-hi
- oracle-linux-upgrade-libreoffice-help-hr
- oracle-linux-upgrade-libreoffice-help-hu
- oracle-linux-upgrade-libreoffice-help-id
- oracle-linux-upgrade-libreoffice-help-it
- oracle-linux-upgrade-libreoffice-help-ja
- oracle-linux-upgrade-libreoffice-help-ko
- oracle-linux-upgrade-libreoffice-help-lt
- oracle-linux-upgrade-libreoffice-help-lv
- oracle-linux-upgrade-libreoffice-help-nb
- oracle-linux-upgrade-libreoffice-help-nl
- oracle-linux-upgrade-libreoffice-help-nn
- oracle-linux-upgrade-libreoffice-help-pl
- oracle-linux-upgrade-libreoffice-help-pt-br
- oracle-linux-upgrade-libreoffice-help-pt-pt
- oracle-linux-upgrade-libreoffice-help-ro
- oracle-linux-upgrade-libreoffice-help-ru
- oracle-linux-upgrade-libreoffice-help-si
- oracle-linux-upgrade-libreoffice-help-sk
- oracle-linux-upgrade-libreoffice-help-sl
- oracle-linux-upgrade-libreoffice-help-sv
- oracle-linux-upgrade-libreoffice-help-ta
- oracle-linux-upgrade-libreoffice-help-tr
- oracle-linux-upgrade-libreoffice-help-uk
- oracle-linux-upgrade-libreoffice-help-zh-hans
- oracle-linux-upgrade-libreoffice-help-zh-hant
- oracle-linux-upgrade-libreoffice-impress
- oracle-linux-upgrade-libreofficekit
- oracle-linux-upgrade-libreoffice-langpack-af
- oracle-linux-upgrade-libreoffice-langpack-ar
- oracle-linux-upgrade-libreoffice-langpack-as
- oracle-linux-upgrade-libreoffice-langpack-bg
- oracle-linux-upgrade-libreoffice-langpack-bn
- oracle-linux-upgrade-libreoffice-langpack-br
- oracle-linux-upgrade-libreoffice-langpack-ca
- oracle-linux-upgrade-libreoffice-langpack-cs
- oracle-linux-upgrade-libreoffice-langpack-cy
- oracle-linux-upgrade-libreoffice-langpack-da
- oracle-linux-upgrade-libreoffice-langpack-de
- oracle-linux-upgrade-libreoffice-langpack-dz
- oracle-linux-upgrade-libreoffice-langpack-el
- oracle-linux-upgrade-libreoffice-langpack-en
- oracle-linux-upgrade-libreoffice-langpack-es
- oracle-linux-upgrade-libreoffice-langpack-et
- oracle-linux-upgrade-libreoffice-langpack-eu
- oracle-linux-upgrade-libreoffice-langpack-fa
- oracle-linux-upgrade-libreoffice-langpack-fi
- oracle-linux-upgrade-libreoffice-langpack-fr
- oracle-linux-upgrade-libreoffice-langpack-ga
- oracle-linux-upgrade-libreoffice-langpack-gl
- oracle-linux-upgrade-libreoffice-langpack-gu
- oracle-linux-upgrade-libreoffice-langpack-he
- oracle-linux-upgrade-libreoffice-langpack-hi
- oracle-linux-upgrade-libreoffice-langpack-hr
- oracle-linux-upgrade-libreoffice-langpack-hu
- oracle-linux-upgrade-libreoffice-langpack-id
- oracle-linux-upgrade-libreoffice-langpack-it
- oracle-linux-upgrade-libreoffice-langpack-ja
- oracle-linux-upgrade-libreoffice-langpack-kk
- oracle-linux-upgrade-libreoffice-langpack-kn
- oracle-linux-upgrade-libreoffice-langpack-ko
- oracle-linux-upgrade-libreoffice-langpack-lt
- oracle-linux-upgrade-libreoffice-langpack-lv
- oracle-linux-upgrade-libreoffice-langpack-mai
- oracle-linux-upgrade-libreoffice-langpack-ml
- oracle-linux-upgrade-libreoffice-langpack-mr
- oracle-linux-upgrade-libreoffice-langpack-nb
- oracle-linux-upgrade-libreoffice-langpack-nl
- oracle-linux-upgrade-libreoffice-langpack-nn
- oracle-linux-upgrade-libreoffice-langpack-nr
- oracle-linux-upgrade-libreoffice-langpack-nso
- oracle-linux-upgrade-libreoffice-langpack-or
- oracle-linux-upgrade-libreoffice-langpack-pa
- oracle-linux-upgrade-libreoffice-langpack-pl
- oracle-linux-upgrade-libreoffice-langpack-pt-br
- oracle-linux-upgrade-libreoffice-langpack-pt-pt
- oracle-linux-upgrade-libreoffice-langpack-ro
- oracle-linux-upgrade-libreoffice-langpack-ru
- oracle-linux-upgrade-libreoffice-langpack-si
- oracle-linux-upgrade-libreoffice-langpack-sk
- oracle-linux-upgrade-libreoffice-langpack-sl
- oracle-linux-upgrade-libreoffice-langpack-sr
- oracle-linux-upgrade-libreoffice-langpack-ss
- oracle-linux-upgrade-libreoffice-langpack-st
- oracle-linux-upgrade-libreoffice-langpack-sv
- oracle-linux-upgrade-libreoffice-langpack-ta
- oracle-linux-upgrade-libreoffice-langpack-te
- oracle-linux-upgrade-libreoffice-langpack-th
- oracle-linux-upgrade-libreoffice-langpack-tn
- oracle-linux-upgrade-libreoffice-langpack-tr
- oracle-linux-upgrade-libreoffice-langpack-ts
- oracle-linux-upgrade-libreoffice-langpack-uk
- oracle-linux-upgrade-libreoffice-langpack-ve
- oracle-linux-upgrade-libreoffice-langpack-xh
- oracle-linux-upgrade-libreoffice-langpack-zh-hans
- oracle-linux-upgrade-libreoffice-langpack-zh-hant
- oracle-linux-upgrade-libreoffice-langpack-zu
- oracle-linux-upgrade-libreoffice-math
- oracle-linux-upgrade-libreoffice-ogltrans
- oracle-linux-upgrade-libreoffice-opensymbol-fonts
- oracle-linux-upgrade-libreoffice-pdfimport
- oracle-linux-upgrade-libreoffice-pyuno
- oracle-linux-upgrade-libreoffice-sdk
- oracle-linux-upgrade-libreoffice-sdk-doc
- oracle-linux-upgrade-libreoffice-ure
- oracle-linux-upgrade-libreoffice-ure-common
- oracle-linux-upgrade-libreoffice-wiki-publisher
- oracle-linux-upgrade-libreoffice-writer
- oracle-linux-upgrade-libreoffice-x11
- oracle-linux-upgrade-libreoffice-xsltfilter
Advanced vulnerability management analytics and reporting.
Key Features
- Lightweight Endpoint Agent
- Live Dashboards
- Real Risk Prioritization
- IT-Integrated Remediation Projects
- Cloud, Virtual, and Container Assessment
- Integrated Threat Feeds
- Easy-to-Use RESTful API
- Automation-Assisted Patching
- Automated Containment
With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.
– Scott Cheney, Manager of Information Security, Sierra View Medical Center