CVE-2024-3044

[Rico Tzschichholz]

CVE-2024-3044: "Graphic on-click binding allows unchecked script execution"
https://www.libreoffice.org/about-us/security/advisories/cve-2024-3044/

https://cgit.freedesktop.org/libreoffice/core/commit/?id=3f1272c0e2e3aa30e6c781a2bcd83e98d62408b7
https://gerrit.libreoffice.org/c/core/+/165403

https://ubuntu.com/security/CVE-2024-3044

* Noble 24.04: Fix is included in 24.2.3 SRU
  - https://bugs.launchpad.net/ubuntu/+source/libreoffice/+bug/2064667
* Mantic 23.10: Fix is included in 7.6.7 SRU
  - https://bugs.launchpad.net/ubuntu/+source/libreoffice/+bug/2065152
* Jammy 22.04: Backport of patch to 7.3.7 required
  - https://git.launchpad.net/~libreoffice/ubuntu/+source/libreoffice/log/?h=wip/jammy-7.3
* Focal 20.04: Backport of patch to 6.4.7 required
  - https://git.launchpad.net/~libreoffice/ubuntu/+source/libreoffice/log/?h=wip/focal-6.4

[Marc Deslauriers (mdeslaur)]

Thanks for the debdiffs, I will prepare packages in the security PPA and will comment back

[Rico Tzschichholz (ricotz)]

@mdeslaur: Thanks!

What do to about SRUs for mantic and noble?

7.6.7 for mantic is waiting in the unapproved queue and therefore could be repacked as security update.

24.2.3 for noble is already built and ready and should go through SRU process.

[Marc Deslauriers (mdeslaur)]

Since they are new upstream versions, and are already going through the SRU process, I'll wait until they are verified-done, and I will do a no-change rebuild of them into the -security pocket.

Does that sound reasonable? Thanks!

[Rico Tzschichholz (ricotz)]

Acknowledged!

[Andreas Hasenack (ahasenack)]

@mdeslaur, LP: #2064667 was just released into noble-updates.

[Marc Deslauriers (mdeslaur)]

These were all released:

https://ubuntu.com/security/notices/USN-6789-1