<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /></head><body style='font-size: 10pt; font-family: Verdana,Geneva,sans-serif'> <p>Hi Guys not sure if you guys have seen these CVE's but this surfaced on the gentoo security list.</p> <div> </div> <p><br /></p> <p>-------- Original Message --------</p> <table border="0" cellspacing="0" cellpadding="0"> <tbody> <tr> <th align="right" valign="baseline" nowrap="nowrap">Subject:</th> <td>[gentoo-announce] [ GLSA 201611-03 ] LibreOffice, OpenOffice: Multiple vulnerabilities</td> </tr> <tr> <th align="right" valign="baseline" nowrap="nowrap">Date:</th> <td>2016-11-04 08:57</td> </tr> <tr> <th align="right" valign="baseline" nowrap="nowrap">From:</th> <td>Aaron Bauman <bman@gentoo.org></td> </tr> <tr> <th align="right" valign="baseline" nowrap="nowrap">To:</th> <td>gentoo-announce@lists.gentoo.org</td> </tr> </tbody> </table> <p><br /></p>  <p><br /></p>  <p><br /></p> <p><br /></p> <pre style="color: #000000; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; white-space: pre-wrap;">- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201611-03 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - <a class="moz-txt-link-freetext" href="https://security.gentoo.org/">https://security.gentoo.org/</a> - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: LibreOffice, OpenOffice: Multiple vulnerabilities Date: November 04, 2016 Bugs: #565026, #587566 ID: 201611-03 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulnerabilities have been found in both LibreOffice and OpenOffice, the worst of which allows for the remote execution of arbitrary code. Background ========== LibreOffice is a powerful office suite; its clean interface and powerful tools let you unleash your creativity and grow your productivity. Apache OpenOffice is the leading open-source office software suite for word processing, spreadsheets, presentations, graphics, databases and more. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 app-office/libreoffice < 5.1.4.2 >= 5.1.4.2 2 app-office/libreoffice-bin < 5.1.4.2 >= 5.1.4.2 3 app-office/openoffice-bin < 4.1.2 >= 4.1.2 ------------------------------------------------------------------- 3 affected packages Description =========== Multiple vulnerabilities have been found in both LibreOffice and OpenOffice. Please review the referenced CVE's for specific information regarding each. Impact ====== Remote attackers could obtain sensitive information, cause a Denial of Service condition, or execute arbitrary code. Workaround ========== There is no known work around at this time. Resolution ========== All LibreOffice users should upgrade their respective packages to the latest version: <code> # emerge --sync # emerge --ask --oneshot --verbose ">=app-office/libreoffice-5.1.4.2" # emerge --ask --oneshot --verbose ">=app-office/libreoffice-bin-debug-5.1.4.2" <code> All OpenOffice users should upgrade to the latest version: <code> # emerge --sync # emerge --ask --oneshot --verbose ">=app-office/openoffice-bin-4.1.2"<code> References ========== [ 1 ] CVE-2015-4551 <a class="moz-txt-link-freetext" href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4551">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4551</a> [ 2 ] CVE-2015-5212 <a class="moz-txt-link-freetext" href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5212">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5212</a> [ 3 ] CVE-2015-5213 <a class="moz-txt-link-freetext" href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5213">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5213</a> [ 4 ] CVE-2015-5214 <a class="moz-txt-link-freetext" href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5214">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5214</a> [ 5 ] CVE-2016-4324 <a class="moz-txt-link-freetext" href="http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4324">http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4324</a> Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: <a class="moz-txt-link-freetext" href="https://security.gentoo.org/glsa/201611-03">https://security.gentoo.org/glsa/201611-03</a> Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to <a class="moz-txt-link-abbreviated" href="mailto:security@gentoo.org">security@gentoo.org</a> or alternatively, you may file a bug at <a class="moz-txt-link-freetext" href="https://bugs.gentoo.org">https://bugs.gentoo.org</a>. License ======= Copyright 2016 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. <a class="moz-txt-link-freetext" href="http://creativecommons.org/licenses/by-sa/2.5">http://creativecommons.org/licenses/by-sa/2.5</a></pre> </body></html>