This update brings LibreOffice to version 5.0.2, a major version update.

It brings lots of new features, bugfixes and also security fixes.

Features as seen on http://www.libreoffice.org/discover/new-features/

  - LibreOffice 5.0 ships an impressive number of new     features for its spreadsheet module, Calc: complex     formulae image cropping, new functions, more powerful     conditional formatting, table addressing and much more.
    Calc's blend of performance and features makes it an     enterprise-ready, heavy duty spreadsheet application     capable of handling all kinds of workload for an     impressive range of use cases

  - New icons, major improvements to menus and sidebar : no     other LibreOffice version has looked that good and     helped you be creative and get things done the right     way. In addition, style management is now more intuitive     thanks to the visualization of styles right in the     interface.

  - LibreOffice 5 ships with numerous improvements to     document import and export filters for MS Office, PDF,     RTF, and more. You can now timestamp PDF documents     generated with LibreOffice and enjoy enhanced document     conversion fidelity all around.

The Pentaho Flow Reporting Engine is now added and used.

Security issues fixed :

  - CVE-2014-8146: The resolveImplicitLevels function in     common/ubidi.c in the Unicode Bidirectional Algorithm     implementation in ICU4C in International Components for     Unicode (ICU) before 55.1 did not properly track     directionally isolated pieces of text, which allowed     remote attackers to cause a denial of service     (heap-based buffer overflow) or possibly execute     arbitrary code via crafted text.

  - CVE-2014-8147: The resolveImplicitLevels function in     common/ubidi.c in the Unicode Bidirectional Algorithm     implementation in ICU4C in International Components for     Unicode (ICU) before 55.1 used an integer data type that     is inconsistent with a header file, which allowed remote     attackers to cause a denial of service (incorrect malloc     followed by invalid free) or possibly execute arbitrary     code via crafted text.

  - CVE-2015-4551: An arbitrary file disclosure     vulnerability in Libreoffice and Openoffice Calc and     Writer was fixed.

  - CVE-2015-1774: The HWP filter in LibreOffice allowed     remote attackers to cause a denial of service (crash) or     possibly execute arbitrary code via a crafted HWP     document, which triggered an out-of-bounds write.

  - CVE-2015-5212: A LibreOffice 'PrinterSetup Length'     integer underflow vulnerability could be used by     attackers supplying documents to execute code as the     user opening the document.

  - CVE-2015-5213: A LibreOffice 'Piece Table Counter'     invalid check design error vulnerability allowed     attackers supplying documents to execute code as the     user opening the document.

  - CVE-2015-5214: Multiple Vendor LibreOffice Bookmark     Status Memory Corruption Vulnerability allowed attackers     supplying documents to execute code as the user opening     the document.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

icu was updated to fix two security issues.

These security issues were fixed :

CVE-2014-8147: The resolveImplicitLevels function in common/ubidi.c in the Unicode Bidirectional Algorithm implementation in ICU4C in International Components for Unicode (ICU) used an integer data type that is inconsistent with a header file, which allowed remote attackers to cause a denial of service (incorrect malloc followed by invalid free) or possibly execute arbitrary code via crafted text (bsc#929629).

CVE-2014-8146: The resolveImplicitLevels function in common/ubidi.c in the Unicode Bidirectional Algorithm implementation in ICU4C in International Components for Unicode (ICU) did not properly track directionally isolated pieces of text, which allowed remote attackers to cause a denial of service (heap-based buffer overflow) or possibly execute arbitrary code via crafted text (bsc#929629).

CVE-2016-6293: The uloc_acceptLanguageFromHTTP function in common/uloc.cpp in International Components for Unicode (ICU) for C/C++ did not ensure that there is a '\0' character at the end of a certain temporary array, which allowed remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a call with a long httpAcceptLanguage argument (bsc#990636).

CVE-2017-7868: International Components for Unicode (ICU) for C/C++ 2017-02-13 has an out-of-bounds write caused by a heap-based buffer overflow related to the utf8TextAccess function in common/utext.cpp and the utext_moveIndex32* function (bsc#1034674)

CVE-2017-7867: International Components for Unicode (ICU) for C/C++ 2017-02-13 has an out-of-bounds write caused by a heap-based buffer overflow related to the utf8TextAccess function in common/utext.cpp and the utext_setNativeIndex* function (bsc#1034678)

CVE-2017-14952: Double free in i18n/zonemeta.cpp in International Components for Unicode (ICU) for C/C++ allowed remote attackers to execute arbitrary code via a crafted string, aka a 'redundant UVector entry clean up function call' issue (bnc#1067203)

CVE-2017-17484: The ucnv_UTF8FromUTF8 function in ucnv_u8.cpp in International Components for Unicode (ICU) for C/C++ mishandled ucnv_convertEx calls for UTF-8 to UTF-8 conversion, which allowed remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted string, as demonstrated by ZNC (bnc#1072193)

CVE-2017-15422: An integer overflow in icu during persian calendar date processing could lead to incorrect years shown (bnc#1077999)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Apple iTunes running on the remote host is prior to 12.3. It is, therefore, affected by multiple vulnerabilities in the WebKit, CoreText, and ICU components, and in the bundled version of the Microsoft Visual Studio C++ Redistributable Package. An attacker can exploit these vulnerabilities to cause a denial of service, execute arbitrary code, or gain access to encrypted SMB credentials.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

icu was updated to fix two security issues. These security issues were fixed :

  - CVE-2014-8147: The resolveImplicitLevels function in     common/ubidi.c in the Unicode Bidirectional Algorithm     implementation in ICU4C in International Components for     Unicode (ICU) used an integer data type that is     inconsistent with a header file, which allowed remote     attackers to cause a denial of service (incorrect malloc     followed by invalid free) or possibly execute arbitrary     code via crafted text (bsc#929629).

  - CVE-2014-8146: The resolveImplicitLevels function in     common/ubidi.c in the Unicode Bidirectional Algorithm     implementation in ICU4C in International Components for     Unicode (ICU) did not properly track directionally     isolated pieces of text, which allowed remote attackers     to cause a denial of service (heap-based buffer     overflow) or possibly execute arbitrary code via crafted     text (bsc#929629).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

icu was updated to fix two security issues.

These security issues were fixed :

  - CVE-2014-8147: The resolveImplicitLevels function in     common/ubidi.c in the Unicode Bidirectional Algorithm     implementation in ICU4C in International Components for     Unicode (ICU) used an integer data type that is     inconsistent with a header file, which allowed remote     attackers to cause a denial of service (incorrect malloc     followed by invalid free) or possibly execute arbitrary     code via crafted text (bsc#929629).

  - CVE-2014-8146: The resolveImplicitLevels function in     common/ubidi.c in the Unicode Bidirectional Algorithm     implementation in ICU4C in International Components for     Unicode (ICU) did not properly track directionally     isolated pieces of text, which allowed remote attackers     to cause a denial of service (heap-based buffer     overflow) or possibly execute arbitrary code via crafted     text (bsc#929629). This update was imported from the     SUSE:SLE-12:Update update project.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The resolveImplicitLevels function in common/ubidi.c in the Unicode Bidirectional Algorithm implementation     in ICU4C in International Components for Unicode (ICU) before 55.1 does not properly track directionally     isolated pieces of text, which allows remote attackers to cause a denial of service (heap-based buffer     overflow) or possibly execute arbitrary code via crafted text. (CVE-2014-8146)

Note that Nessus relies on the presence of the package as reported by the vendor.

This update brings LibreOffice to version 5.0.4, a major version update.

It brings lots of new features, bug fixes and also security fixes.

Features as seen on http://www.libreoffice.org/discover/new-features/

  - LibreOffice 5.0 ships an impressive number of new     features for its spreadsheet module, Calc: complex     formulae image cropping, new functions, more powerful     conditional formatting, table addressing and much more.
    Calc's blend of performance and features makes it an     enterprise-ready, heavy duty spreadsheet application     capable of handling all kinds of workload for an     impressive range of use cases

  - New icons, major improvements to menus and sidebar : no     other LibreOffice version has looked that good and     helped you be creative and get things done the right     way. In addition, style management is now more intuitive     thanks to the visualization of styles right in the     interface.

  - LibreOffice 5 ships with numerous improvements to     document import and export filters for MS Office, PDF,     RTF, and more. You can now timestamp PDF documents     generated with LibreOffice and enjoy enhanced document     conversion fidelity all around.

The Pentaho Flow Reporting Engine is now added and used.

Security issues fixed :

  - CVE-2014-8146: The resolveImplicitLevels function in     common/ubidi.c in the Unicode Bidirectional Algorithm     implementation in ICU4C in International Components for     Unicode (ICU) before 55.1 did not properly track     directionally isolated pieces of text, which allowed     remote attackers to cause a denial of service     (heap-based buffer overflow) or possibly execute     arbitrary code via crafted text.

  - CVE-2014-8147: The resolveImplicitLevels function in     common/ubidi.c in the Unicode Bidirectional Algorithm     implementation in ICU4C in International Components for     Unicode (ICU) before 55.1 used an integer data type that     is inconsistent with a header file, which allowed remote     attackers to cause a denial of service (incorrect malloc     followed by invalid free) or possibly execute arbitrary     code via crafted text.

  - CVE-2015-4551: An arbitrary file disclosure     vulnerability in Libreoffice and Openoffice Calc and     Writer was fixed.

  - CVE-2015-5212: A LibreOffice 'PrinterSetup Length'     integer underflow vulnerability could be used by     attackers supplying documents to execute code as the     user opening the document.

  - CVE-2015-5213: A LibreOffice 'Piece Table Counter'     invalid check design error vulnerability allowed     attackers supplying documents to execute code as the     user opening the document.

  - CVE-2015-5214: Multiple Vendor LibreOffice Bookmark     Status Memory Corruption Vulnerability allowed attackers     supplying documents to execute code as the user opening     the document.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities were discovered in the International Components for Unicode (ICU) library.

  - CVE-2014-8146     The Unicode Bidirectional Algorithm implementation does     not properly track directionally isolated pieces of     text, which allows remote attackers to cause a denial of     service (heap-based buffer overflow) or possibly execute     arbitrary code via crafted text.

  - CVE-2014-8147     The Unicode Bidirectional Algorithm implementation uses     an integer data type that is inconsistent with a header     file, which allows remote attackers to cause a denial of     service (incorrect malloc followed by invalid free) or     possibly execute arbitrary code via crafted text.

  - CVE-2015-4760     The Layout Engine was missing multiple boundary checks.
    These could lead to buffer overflows and memory     corruption. A specially crafted file could cause an     application using ICU to parse untrusted font files to     crash and, possibly, execute arbitrary code.

Additionally, it was discovered that the patch applied to ICU in DSA-3187-1 for CVE-2014-6585 was incomplete, possibly leading to an invalid memory access. This could allow remote attackers to disclose portion of private memory via crafted font files.

Qt 5 was updated to the 5.5.1 release to deliver upstream improvements and fixes to Qt functionality.

The following Security fixes are contained in QtWebEngineCore :

  - ICU: CVE-2014-8146, CVE-2014-8147

  - Blink: CVE-2015-1284, CVE-2015-1291, CVE-2015-1292

  - Skia: CVE-2015-1294

  - V8: CVE-2015-1290

The following packages were rebuilt because they use private headers :

  - calibre

  - fcitx-qt5

  - frameworkintegration

  - kwayland

  - kwin5,

  - lxqt-powermanagement

  - lxqt-qtplugin

icu was updated to fix two security issues. These security issues were fixed :

  - CVE-2014-8147: The resolveImplicitLevels function in     common/ubidi.c in the Unicode Bidirectional Algorithm     implementation in ICU4C in International Components for     Unicode (ICU) used an integer data type that is     inconsistent with a header file, which allowed remote     attackers to cause a denial of service (incorrect malloc     followed by invalid free) or possibly execute arbitrary     code via crafted text (bsc#929629).

  - CVE-2014-8146: The resolveImplicitLevels function in     common/ubidi.c in the Unicode Bidirectional Algorithm     implementation in ICU4C in International Components for     Unicode (ICU) did not properly track directionally     isolated pieces of text, which allowed remote attackers     to cause a denial of service (heap-based buffer     overflow) or possibly execute arbitrary code via crafted     text (bsc#929629).

  - CVE-2016-6293: The uloc_acceptLanguageFromHTTP function     in common/uloc.cpp in International Components for     Unicode (ICU) for C/C++ did not ensure that there is a     '\0' character at the end of a certain temporary array,     which allowed remote attackers to cause a denial of     service (out-of-bounds read) or possibly have     unspecified other impact via a call with a long     httpAcceptLanguage argument (bsc#990636).

  - CVE-2017-7868: International Components for Unicode     (ICU) for C/C++ 2017-02-13 has an out-of-bounds write     caused by a heap-based buffer overflow related to the     utf8TextAccess function in common/utext.cpp and the     utext_moveIndex32* function (bsc#1034674)

  - CVE-2017-7867: International Components for Unicode     (ICU) for C/C++ 2017-02-13 has an out-of-bounds write     caused by a heap-based buffer overflow related to the     utf8TextAccess function in common/utext.cpp and the     utext_setNativeIndex* function (bsc#1034678)

  - CVE-2017-14952: Double free in i18n/zonemeta.cpp in     International Components for Unicode (ICU) for C/C++     allowed remote attackers to execute arbitrary code via a     crafted string, aka a 'redundant UVector entry clean up     function call' issue (bnc#1067203)

  - CVE-2017-17484: The ucnv_UTF8FromUTF8 function in     ucnv_u8.cpp in International Components for Unicode     (ICU) for C/C++ mishandled ucnv_convertEx calls for     UTF-8 to UTF-8 conversion, which allowed remote     attackers to cause a denial of service (stack-based     buffer overflow and application crash) or possibly have     unspecified other impact via a crafted string, as     demonstrated by ZNC (bnc#1072193)

  - CVE-2017-15422: An integer overflow in icu during     persian calendar date processing could lead to incorrect     years shown (bnc#1077999)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The mobile device is running a version of iOS prior to version 9.0. It is, therefore, affected by vulnerabilities in the following components :

  - Apple Pay
  - AppleKeyStore
  - Application Store
  - Audio
  - Certificate Trust Policy
  - CFNetwork
  - CFNetwork Cookies
  - CFNetwork FTPProtocol
  - CFNetwork Proxies
  - CFNetwork SSL
  - CommonCrypto 
  - CoreAnimation
  - CoreCrypto
  - CoreText
  - Data Detectors Engine
  - Dev Tools
  - Disk Images
  - dyld
  - Game Center
  - ICU
  - IOAcceleratorFamily
  - IOHIDFamily
  - IOKit
  - IOMobileFrameBuffer
  - IOStorageFamily
  - iTunes Store
  - JavaScriptCore
  - Kernel
  - libc
  - libpthread
  - Mail
  - Multipeer Connectivity
  - NetworkExtension
  - OpenSSL
  - PluginKit
  - removefile
  - Safari
  - Safari Safe Browsing
  - Security
  - Siri
  - SpringBoard
  - SQLite
  - tidy
  - WebKit
  - WebKit Canvas
  - WebKit Page Loading

ID	Name	Product	Family	Published	Updated	Severity
86757	SUSE SLED12 / SLES12 Security Update : Recommended update for LibreOffice (SUSE-SU-2015:1915-1)	Nessus	SuSE Local Security Checks	11/5/2015	1/6/2021	high
118258	SUSE SLES12 Security Update : icu (SUSE-SU-2018:1401-2)	Nessus	SuSE Local Security Checks	10/22/2018	2/7/2022	critical
86601	Apple iTunes < 12.3 Multiple Vulnerabilities (uncredentialed check)	Nessus	Peer-To-Peer File Sharing	10/26/2015	11/20/2019	high
102912	SUSE SLED12 / SLES12 Security Update : icu (SUSE-SU-2017:2318-1)	Nessus	SuSE Local Security Checks	9/1/2017	11/24/2025	high
102967	openSUSE Security Update : icu (openSUSE-2017-1011)	Nessus	SuSE Local Security Checks	9/6/2017	11/24/2025	high
218651	Linux Distros Unpatched Vulnerability : CVE-2014-8146	Nessus	Misc.	3/4/2025	9/10/2025	critical
88575	SUSE SLED11 Security Update : Recommended update for LibreOffice (SUSE-SU-2016:0324-1)	Nessus	SuSE Local Security Checks	2/4/2016	1/6/2021	high
85162	Debian DSA-3323-1 : icu - security update	Nessus	Debian Local Security Checks	8/3/2015	1/11/2021	critical
87627	openSUSE Security Update : Qt 5 (openSUSE-2015-953)	Nessus	SuSE Local Security Checks	12/29/2015	1/19/2021	high
110093	SUSE SLED12 / SLES12 Security Update : icu (SUSE-SU-2018:1401-1)	Nessus	SuSE Local Security Checks	5/24/2018	10/1/2024	critical
85987	Apple iOS < 9.0 Multiple Vulnerabilities	Nessus	Mobile Devices	9/17/2015	8/10/2026	critical

Detections

Analytics

Plugins Search

high

critical

high

high

high

critical

high

critical

high

critical

critical