CVE-2024-6472

[Rico Tzschichholz]

CVE-2024-6472: "Ability to trust not validated macro signatures removed in high security mode"
https://www.libreoffice.org/about-us/security/advisories/cve-2024-6472/

https://git.libreoffice.org/core/+/da570d9adb324b143ab5a05683fc17a1c90feaec
https://gerrit.libreoffice.org/c/core/+/169525

https://ubuntu.com/security/CVE-2024-6472

* Noble 24.04: Fix is included in 24.2.5 SRU
  - https://bugs.launchpad.net/ubuntu/+source/libreoffice/+bug/2073054
* Jammy 22.04: Backport of patch to 7.3.7 required
  - https://gerrit.libreoffice.org/c/core/+/171313
  - https://git.launchpad.net/~libreoffice/ubuntu/+source/libreoffice/log/?h=wip/jammy-7.3
* Focal 20.04: Backport of patch to 6.4.7 required
  - https://gerrit.libreoffice.org/c/core/+/171323
  - https://git.launchpad.net/~libreoffice/ubuntu/+source/libreoffice/log/?h=wip/focal-6.4

[Marc Deslauriers (mdeslaur)]

Thanks for preparing these Rico, I'll prepare the security updates!

[Marc Deslauriers (mdeslaur)]

Hi Rico, the debdiff in comment #1 contains a patch that doesn't actually apply to jammy. Could you please fix it? Thanks!

[Rico Tzschichholz (ricotz)]

Hello Marc, I am sorry for the wrong patch. This should be fixed now.

[Marc Deslauriers (mdeslaur)]

Thanks Rico!

[Launchpad Janitor (janitor)]

This bug was fixed in the package libreoffice - 4:24.2.5-0ubuntu0.24.04.2

---------------
libreoffice (4:24.2.5-0ubuntu0.24.04.2) noble-security; urgency=medium

  * No-change rebuild in the -security pocket to fix CVE-2024-6472.
    (LP: #2076130)

 -- Marc Deslauriers <email address hidden> Tue, 13 Aug 2024 10:32:23 -0400

[Launchpad Janitor (janitor)]

This bug was fixed in the package libreoffice - 1:6.4.7-0ubuntu0.20.04.11

---------------
libreoffice (1:6.4.7-0ubuntu0.20.04.11) focal-security; urgency=medium

  * SECURITY UPDATE: Ability to trust not validated macro signatures
    removed in high security mode (LP: #2076130)
    - debian/patches/CVE-2024-6472.patch: remove ability to trust not
      validated macro signatures in high security
    - CVE-2024-6472

 -- Rico Tzschichholz <email address hidden> Mon, 05 Aug 2024 21:28:04 +0200

[Launchpad Janitor (janitor)]

This bug was fixed in the package libreoffice - 1:7.3.7-0ubuntu0.22.04.6

---------------
libreoffice (1:7.3.7-0ubuntu0.22.04.6) jammy-security; urgency=medium

  * SECURITY UPDATE: Ability to trust not validated macro signatures
    removed in high security mode (LP: #2076130)
    - debian/patches/CVE-2024-6472.patch: remove ability to trust not
      validated macro signatures in high security
    - CVE-2024-6472

 -- Rico Tzschichholz <email address hidden> Mon, 05 Aug 2024 21:22:27 +0200