Bug 1026640 (CVE-2017-3157)

Summary: VUL-0: CVE-2017-3157: libreoffice: Arbitrary file disclosure in Calc and Writer
Product: [Novell Products] SUSE Security Incidents Reporter: Marcus Meissner <meissner>
Component: IncidentsAssignee: Tomáš Chvátal <tchvatal>
Status: RESOLVED FIXED QA Contact: Security Team bot <security-team>
Severity: Normal    
Priority: P5 - None CC: smash_bz
Version: unspecified   
Target Milestone: ---   
Hardware: Other   
OS: Other   
URL: https://smash.suse.de/issue/180848/
Whiteboard:
Found By: Security Response Team Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---

Description Marcus Meissner 2017-02-23 12:06:37 UTC 
http://www.libreoffice.org/about-us/security/advisories/cve-2017-3157/

CVE-2017-3157

Title: CVE-2017-3157 Arbitrary file disclosure in Calc and Writer

Announced: February 22, 2017

Fixed in: LibreOffice 5.1.6/5.2.2/5.3.0

Description:

Embedded Objects in writer and calc can contain previews of their content. A document can be crafted which contains an embedded object that is a link to an existing file on the targets system. On load the preview of the embedded object will be updated to reflect the content of the file on the target system. In the case of LibreOffice used as an online service that preview of data on the target system could be used to expose details of the environment LibreOffice is running in. In the case of LibreOffice as a standard desktop application, the preview could be concealed in hidden sections and retrieved by the attacker if the document is saved and returned to sender.

In later version of LibreOffice without this flaw the LinkUpdateMode feature has been expanded to additionally control the update of previews of embedded objects as well as its prior function to control the update of embedded object contents.


All users are recommended to upgrade to LibreOffice >= 5.1.6 or >= 5.2.5 or >= 5.3.0

Thanks to Ben Hayak for discovering this flaw.

References:

    CVE-2017-3157
Comment 1 Tomáš Chvátal 2017-02-23 12:13:30 UTC 
No affected codestream?
Comment 2 Marcus Meissner 2017-02-23 12:31:21 UTC 
we seem to have 5.2.3 in SLE 12 SP1+SP2 and openSUSE Leap 42.*

So I think we are good.
Comment 3 Bernhard Wiedemann 2017-02-23 13:01:48 UTC 
This is an autogenerated message for OBS integration:
This bug (1026640) was mentioned in
https://build.opensuse.org/request/show/460020 Factory / libreoffice