libreoffice (1:7.3.7-0ubuntu0.22.04.12) jammy-security; urgency=medium

  * SECURITY UPDATE: Heap buffer overflow in DXF polyline import
    - debian/patches/CVE-2026-6039.patch: stay within max Polygon points
    - CVE-2026-6039
  * SECURITY UPDATE: Heap buffer overflow in EMF+ gradient brush import
    - debian/patches/CVE-2026-6045-0.patch: EMF+ Use variable types according to
      EMFPLUS documentation
    - debian/patches/CVE-2026-6045-1.patch: check that the file can provide the
      claimed data
    - debian/patches/CVE-2026-6045-2.patch: tidy up emfppath.cxx edge cases
    - debian/patches/CVE-2026-6045-3.patch: check that the file can provide the
      claimed data
    - CVE-2026-6045
  * SECURITY UPDATE: Stack buffer overflow in PPT presentation import
    - debian/patches/CVE-2026-8356.patch: SdrEscherImport::RecolorGraphic
      reads but doesn't use FillColors
    - CVE-2026-8356
  * SECURITY UPDATE: Heap buffer overflow in Calc formula compilation
    - debian/patches/CVE-2026-8357.patch: A formula of length L, composed
      entirely of open tokens, needs L+1 slots
    - CVE-2026-8357
  * SECURITY UPDATE: Heap buffer overflow in spreadsheet tracked-changes import
    - debian/patches/CVE-2026-8358.patch: drop malformed duplicate-id calc
      change track actions
    - CVE-2026-8358

 -- Rico Tzschichholz <ricotz@ubuntu.com>  Sun, 28 Jun 2026 12:36:00 +0200

libreoffice (1:7.3.7-0ubuntu0.22.04.11) jammy-security; urgency=medium

  * SECURITY UPDATE: Heap Buffer Overflow in AgileEngine
    - debian/patches/CVE-2026-4430.patch: Conform AlignEngine parsing to
      what section 2.3.4.10 of the spec has
    - CVE-2026-4430

 -- Rico Tzschichholz <ricotz@ubuntu.com>  Wed, 13 May 2026 09:44:03 +0200

libreoffice (1:7.3.7-0ubuntu0.22.04.10) jammy-security; urgency=medium

  * SECURITY UPDATE: PDF signature forgery with adbe.pkcs7.sha1 SubFilter
    - debian/patches/CVE-2025-2866.patch: Improve adbe.pkcs7.sha1 signature
      verification
    - CVE-2025-2866

 -- Rico Tzschichholz <ricotz@ubuntu.com>  Mon, 05 May 2025 17:20:55 +0200

libreoffice (1:7.3.7-0ubuntu0.22.04.9) jammy-security; urgency=medium

  * SECURITY UPDATE: Macro URL arbitrary script execution
    - debian/patches/CVE-2025-1080.patch: Filter out more unwanted command
      URIs
    - CVE-2025-1080

 -- Rico Tzschichholz <ricotz@ubuntu.com>  Thu, 06 Mar 2025 08:58:09 +0100

libreoffice (1:7.3.7-0ubuntu0.22.04.8) jammy-security; urgency=medium

  * SECURITY UPDATE: Path traversal leading to arbitrary .ttf file write
    - debian/patches/CVE-2024-12425.patch: be conservative on allowed temp
      font names
    - CVE-2024-12425
  * SECURITY UPDATE: URL fetching can be used to exfiltrate arbitrary INI
      file values and environment variables
    - debian/patches/CVE-2024-12426-1.patch: consider VndSunStarExpand an
      exotic protocol
    - debian/patches/CVE-2024-12426-2.patch: look at 'embedded' protocols too
    - CVE-2024-12426
    - debian/patches/CVE-2024-12426-3.patch: Fix check for further exotic 
      protocols

 -- Rico Tzschichholz <ricotz@ubuntu.com>  Thu, 23 Jan 2025 14:54:13 +0100

libreoffice (1:7.3.7-0ubuntu0.22.04.7) jammy-security; urgency=medium

  * SECURITY UPDATE: Signatures in "repair mode" should not be trusted
    - debian/patches/CVE-2024-7788.patch: sfx2: SfxObjectShell should
      not trust any signature on repaired package
    - CVE-2024-7788

 -- Rico Tzschichholz <ricotz@ubuntu.com>  Wed, 18 Sep 2024 17:10:51 +0200

libreoffice (1:7.3.7-0ubuntu0.22.04.6) jammy-security; urgency=medium

  * SECURITY UPDATE: Ability to trust not validated macro signatures
    removed in high security mode (LP: #2076130)
    - debian/patches/CVE-2024-6472.patch: remove ability to trust not
      validated macro signatures in high security
    - CVE-2024-6472

 -- Rico Tzschichholz <ricotz@ubuntu.com>  Mon, 05 Aug 2024 21:22:27 +0200

libreoffice (1:7.3.7-0ubuntu0.22.04.5) jammy-security; urgency=medium

  * SECURITY UPDATE: Graphic on-click binding allows unchecked script
     execution
    - debian/patches/CVE-2024-3044.patch: add notify for script use
    - CVE-2024-3044

 -- Rico Tzschichholz <ricotz@ubuntu.com>  Wed, 15 May 2024 09:06:02 +0200

libreoffice (1:7.3.7-0ubuntu0.22.04.4) jammy-security; urgency=medium

  * SECURITY UPDATE: Improper input validation enabling arbitrary Gstreamer
     pipeline injection
    - debian/patches/CVE-2023-6185.patch: escape url passed to gstreamer
    - CVE-2023-6185
  * SECURITY UPDATE: Link targets allow arbitrary script execution
    - debian/patches/CVE-2023-6186-*.patch: multiple commits to fix
      security issues.
    - CVE-2023-6186
  * patches/CppunitTest_desktop_lib-adjust-asserts-so-this-works.patch:
    - Usage of expired certificates in CppunitTest_desktop_lib:
      adjust asserts so this works again

 -- Rico Tzschichholz <ricotz@ubuntu.com>  Mon, 11 Dec 2023 15:19:13 +0100

libreoffice (1:7.3.7-0ubuntu0.22.04.3) jammy-security; urgency=high

  * SECURITY UPDATE: Remote documents loaded without prompt via IFrame
    - debian/patches/CVE-2023-2255-*.patch: multiple commits to fix
      security issues.
    - CVE-2023-2255
  * SECURITY UPDATE: Array Index UnderFlow in Calc Formula Parsing
    - debian/patches/CVE-2023-0950.patch: Obtain actual 0-parameter count
      for OR(), AND() and 1-parameter functions
    - CVE-2023-0950

 -- Rico Tzschichholz <ricotz@ubuntu.com>  Thu, 25 May 2023 22:52:23 +0200

# For older changelog entries, run 'apt-get changelog libreoffice-kde4'
