Caolán McNamara [Tue, 22 Mar 2022 17:22:22 +0000 (17:22 +0000)]
CVE-2022-26307: add Initialization Vectors to password storage
LibreOffice supports the storage of passwords for web connections in
the user’s configuration database. The stored passwords are encrypted
with a single master key provided by the user. A flaw in LibreOffice
existed where master key was poorly encoded resulting in weakening its
entropy from 128 to 43 bits making the stored passwords vulerable to a
brute force attack if an attacker has access to the users stored
config.
old ones default to the current all zero case and continue to work
as before
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/131974 Tested-by: Jenkins Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
(cherry picked from commit 192fa1e3bfc6269f2ebb91716471485a56074aea)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/132306 Reviewed-by: Thorsten Behrens <thorsten.behrens@allotropia.de>
(cherry picked from commit ab77587ec300f5c30084471000663c46ddf25dad)
Caolán McNamara [Mon, 21 Mar 2022 20:58:34 +0000 (20:58 +0000)]
CVE-2022-26307: make hash encoding match decoding
Seeing as old versions of the hash may be in the users config, add a
StorageVersion field to the office config Passwords section which
defaults to 0 to indicate the old hash is in use.
Try the old varient when StorageVersion is 0. When a new encoded master
password it set write StorageVersion of 1 to indicate a new hash is in
use and use the new style when StorageVersion is 1.
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/132080 Tested-by: Jenkins Reviewed-by: Stephan Bergmann <sbergman@redhat.com>
(cherry picked from commit e890f54dbac57f3ab5acf4fbd31222095d3e8ab6)
svl: fix crash if user cancels/closes master password dialog
Caolan McNamara [Sat, 25 Mar 2023 18:15:47 +0000 (18:15 +0000)]
Subject: CVE-2021-25636: only use X509Data
LibreOffice supports digital signatures of ODF documents and macros
within documents, presenting visual aids that no alteration of the
document occurred since the last signing and that the signature is
valid. An Improper Certificate Validation vulnerability in LibreOffice
allowed an attacker to create a digitally signed ODF document, by
manipulating the documentsignatures.xml or macrosignatures.xml stream
within the document to contain both "X509Data" and "KeyValue" children
of the "KeyInfo" tag, which when opened caused LibreOffice to verify
using the "KeyValue" but to report verification with the unrelated
"X509Data" value.
Julien Nabet [Sat, 12 Oct 2019 22:26:10 +0000 (00:26 +0200)]
tdf#128111: "adsrc" doesn't exist from Postgresql 12
Before Postgresql 8.0, there was only "adsrc"
then it's been deprecated
"The adsrc field is historical, and is best not used, because it does not track outside changes
that might affect the representation of the default value.
Reverse-compiling the adbin field (with pg_get_expr for example) is a better way to display the default value
"
and finally it's been removed with version 12
See evolution with:
- https://www.postgresql.org/docs/8/catalog-pg-attrdef.html
- https://www.postgresql.org/docs/11/catalog-pg-attrdef.html
- https://www.postgresql.org/docs/12/catalog-pg-attrdef.html
Eike Rathke [Fri, 16 Aug 2019 13:36:15 +0000 (15:36 +0200)]
Resolves: tdf#126928 allow link updates in an intermediate linked document
... if link updates are allowed in the current document and that
intermediate document resides in a trusted location.
This works with both, the "Always (from trusted locations)" and
the "On request" settings under Tools -> Options -> Calc ->
General. It can't work with documents residing in a non-trusted
location as there is no way to allow updates on demand for a such
loaded document (hidden via formulas).
Prepare for "Japan's Y2K" Gengou calendar era switch after 2019-04-30
The emperor Akihito will abdicate on 2019-04-30. The next emperor
will be Naruhito, but so far neither the new era name (Heisei for
Akihito) nor its abbreviation or a Unicode character are
determined. At least introduce the new era with some dummy names
(Naruhito,Na,N).
Change-Id: I8c0af390ca0408ac259e47e7eaf2e49b5889c9ba
Reviewed-on: https://gerrit.libreoffice.org/58142 Reviewed-by: Eike Rathke <erack@redhat.com> Tested-by: Jenkins
Introduce next Japanese gengou era 'Reiwa'
starting from 2019-05-01, which has been announced officially.
Michael Weghorn [Thu, 31 Jan 2019 08:52:51 +0000 (09:52 +0100)]
tdf#123077 gtk3_kde5: Set KFileWidget's custom widget only once
Since the event filter is only used to set the custom
widget in the KFileWidget, it can and needs to be removed
again once this has been done; which also avoids crashes.
(s. https://gerrit.libreoffice.org/#/c/67185/ for more
infos, where the same thing is done for kde5)
Change-Id: I5c719fb17510916b4730ed5c00bb638df2f183e3
Reviewed-on: https://gerrit.libreoffice.org/67184 Tested-by: Jenkins Reviewed-by: Michael Weghorn <m.weghorn@posteo.de>
(cherry picked from commit 30cc54a4532a732a0cf6dfe9943521978ff7292f)
Reviewed-on: https://gerrit.libreoffice.org/67204 Reviewed-by: Thorsten Behrens <Thorsten.Behrens@CIB.de>
Gbp-Pq: Name tdf123077.diff
The largest change in 1.4.x relevant to the calc code is that the
multi_type_matrix::walk() methods now take a copy of the function
object rather than a reference, to allow for it to take an inline
lambda function. Instead, it does return a instance of the input
function object, similar to how std::for_each() behaves.
In case the function object contains a large data member, try to
make it a moveable so that it will get moved rather than copied
when going through one of the walk() methods.
Reviewed-on: https://gerrit.libreoffice.org/59584 Tested-by: Jenkins Reviewed-by: Kohei Yoshida <libreoffice@kohei.us>
(cherry picked from commit 51f73f35ea61dd81dd3194af50394b98ff1bf8e9)
mdds 1.4.1 is now a minimum requirement.
Reviewed-on: https://gerrit.libreoffice.org/59614 Tested-by: Jenkins Reviewed-by: Kohei Yoshida <libreoffice@kohei.us>
(cherry picked from commit 4d1f735fcf064b18ef2848cc1f5a2a0616b0b33d)
Vincas Dargis [Sat, 4 Aug 2018 14:40:05 +0000 (17:40 +0300)]
[PATCH] apparmor: use dri-enumerate abstraction
Remove backported rule and use new dri-enumerate abstraction instead.
dri-enumerate is available in AppArmor 2.13, which recently migrated
into Debian Buster.
Gemeinsame Unterverzeichnisse: odk-old/config und odk/config.
Gemeinsame Unterverzeichnisse: odk-old/docs und odk/docs.
Gemeinsame Unterverzeichnisse: odk-old/examples und odk/examples.
Gemeinsame Unterverzeichnisse: odk-old/config und odk/config.
Gemeinsame Unterverzeichnisse: odk-old/docs und odk/docs.
Gemeinsame Unterverzeichnisse: odk-old/examples und odk/examples.
14:13 < mst__> _rene_, the toolkit unoapi tests are known to be flaky (in some
system dependent way) e.g. on the Win@6 tinderbox it always
crashes
14:14 < mst__> _rene_, sc.ScAccessible* tests also fail on some systems some of
the time
* Add salsa testsuite
* CVE-2022-26307: add Initialization Vectors to password storage.
LibreOffice supports the storage of passwords for web connections in
the user’s configuration database. The stored passwords are encrypted
with a single master key provided by the user. A flaw in LibreOffice
existed where master key was poorly encoded resulting in weakening its
entropy from 128 to 43 bits making the stored passwords vulerable to a
brute force attack if an attacker has access to the users stored
config.
* fix CVE-2022-26306: LibreOffice supports the storage of passwords for
web connections in the user’s configuration database. The stored
passwords are encrypted with a single master key provided by the
user. A flaw in LibreOffice existed where the required initialization
vector for encryption was always the same which weakens the security
of the encryption making them vulnerable if an attacker has access to
the user's configuration data
* CVE-2022-26305: compare authors using Thumbprint
An Improper Certificate Validation vulnerability in LibreOffice
existed where determining if a macro was signed by a trusted author
was done by only matching the serial number and issuer string of the
used certificate with that of a trusted certificate. This is not
sufficient to verify that the macro was actually signed with the
certificate. An adversary could therefore create an arbitrary
certificate with a serial number and an issuer string identical to a
trusted certificate which LibreOffice would present as belonging to
the trusted author, potentially leading to the user to execute
arbitrary code contained in macros improperly trusted.
* CVE-2021-25636: only use X509Data
LibreOffice supports digital signatures of ODF documents and macros
within documents, presenting visual aids that no alteration of the
document occurred since the last signing and that the signature is
valid. An Improper Certificate Validation vulnerability in LibreOffice
allowed an attacker to create a digitally signed ODF document, by
manipulating the documentsignatures.xml or macrosignatures.xml stream
within the document to contain both "X509Data" and "KeyValue" children
of the "KeyInfo" tag, which when opened caused LibreOffice to verify
using the "KeyValue" but to report verification with the unrelated
"X509Data" value.
* CVE-2022-3140: Insufficient validation of "vnd.libreoffice.command"
URI schemes. LibreOffice supports Office URI Schemes to enable browser
integration of LibreOffice with MS SharePoint server. An additional
scheme 'vnd.libreoffice.command' specific to LibreOffice was added. In
the affected versions of LibreOffice links using that scheme could be
constructed to call internal macros with arbitrary arguments. Which
when clicked on, or activated by document events, could result in
arbitrary script execution without warning.
projects / libreoffice.git / log