-
libreoffice (1:7.4.7-0ubuntu0.22.10.1~bpo18.04.1) bionic-backports; urgency=medium
* Backport from kinetic (LP: #2018714)
* Use internal abseil, gpgmepp, libmwaw, libwps, mdds, orcus, cppunit,
curl, xmlsec, libcmis, libcdr, libetonyek, libvisio, libwpd, libwpg,
graphite and harfbuzz to meat upstream requirements
* Lower dpkg-dev requirement
- buildopts.mk is not available in dpkg-dev < 1.20.1
* Lower libclucene-dev requirement
* Apparmor 2.13 is not available
-- Rico Tzschichholz <email address hidden> Wed, 03 May 2023 19:17:57 +0200
-
libreoffice (1:7.4.6-0ubuntu0.22.10.1~bpo18.04.1) bionic-backports; urgency=medium
* Backport from kinetic (LP: #2009944)
* Use internal abseil, gpgmepp, libmwaw, libwps, mdds, orcus, cppunit,
curl, xmlsec, libcmis, libcdr, libetonyek, libvisio, libwpd, libwpg,
graphite and harfbuzz to meat upstream requirements
* Lower dpkg-dev requirement
- buildopts.mk is not available in dpkg-dev < 1.20.1
* Lower libclucene-dev requirement
* Apparmor 2.13 is not available
-- Rico Tzschichholz <email address hidden> Thu, 09 Mar 2023 14:07:05 +0100
-
libreoffice (1:7.3.7-0ubuntu0.22.04.1~bpo18.04.1) bionic-backports; urgency=medium
* Backport from jammy (LP: #1996082)
* Lower dpkg-dev requirement
- buildopts.mk is not available in dpkg-dev < 1.20.1
* Lower libclucene-dev requirement
* Use internal abseil, gpgmepp, libmwaw, libwps, mdds, orcus,
cppunit, curl, xmlsec, libcmis, libcdr, libetonyek,
libvisio, libwpd, libwpg to meat upstream requirements
* Apparmor 2.13 is not available
-- Rico Tzschichholz <email address hidden> Tue, 08 Nov 2022 12:22:22 +0100
-
libreoffice (1:7.3.6-0ubuntu0.22.04.2~bpo18.04.1) bionic-backports; urgency=medium
* Backport from jammy
libreoffice (1:7.3.6-0ubuntu0.22.04.1~bpo18.04.1) bionic-backports; urgency=medium
* Backport from jammy (LP: #1990382)
* Lower dpkg-dev requirement
- buildopts.mk is not available in dpkg-dev < 1.20.1
* Lower libclucene-dev requirement
* Use internal abseil, gpgmepp, libmwaw, libwps, mdds, orcus,
cppunit, curl, xmlsec, libcmis, libcdr, libetonyek,
libvisio, libwpd, libwpg to meat upstream requirements
* Apparmor 2.13 is not available
libreoffice (1:7.3.6-0ubuntu0.22.04.2) jammy-security; urgency=medium
* SECURITY UPDATE: arbitrary script execution via Office URI Schemes
- debian/patches/CVE-2022-3140-4.patch: check impress/calc IFrame
FrameURL target in xmloff/source/draw/ximpshap.cxx.
- CVE-2022-3140
-- Rico Tzschichholz <email address hidden> Fri, 21 Oct 2022 13:35:33 +0200
-
libreoffice (1:7.3.6-0ubuntu0.22.04.1~bpo18.04.1) bionic-backports; urgency=medium
* Backport from jammy (LP: #1990382)
* Lower dpkg-dev requirement
- buildopts.mk is not available in dpkg-dev < 1.20.1
* Lower libclucene-dev requirement
* Use internal abseil, gpgmepp, libmwaw, libwps, mdds, orcus,
cppunit, curl, xmlsec, libcmis, libcdr, libetonyek,
libvisio, libwpd, libwpg to meat upstream requirements
* Apparmor 2.13 is not available
-- Rico Tzschichholz <email address hidden> Tue, 13 Sep 2022 09:49:44 +0200
-
libreoffice (1:6.0.7-0ubuntu0.18.04.13) bionic-security; urgency=medium
[ Rico Tzschichholz ]
* SECURITY UPDATE: Empty entry in Java class path risks arbitrary
code execution
- debian/patches/CVE-2022-38745.patch: Avoid unnecessary empty
-Djava.class.path=.
- CVE-2022-38745
[ Rene Engelhard ]
* debian/patches/hrk-euro.diff: add EUR to .hr i18n;
add HRK<->EUR conversion rate to Calc and the Euro Wizard
* debian/patches/hrk-euro-default.diff: default to EUR for .hr
-- Rico Tzschichholz <email address hidden> Sun, 26 Mar 2023 20:00:54 +0200
-
libreoffice (1:6.0.7-0ubuntu0.18.04.12) bionic-security; urgency=medium
* SECURITY UPDATE: document encryption stripped via recovery
- debian/patches/CVE-2020-12801-1.patch: store ODF encryption data for
autorecovery in comphelper/source/misc/docpasswordhelper.cxx,
sfx2/source/dialog/filedlghelper.cxx.
- debian/patches/CVE-2020-12801-2.patch: keep encryption information
for autorecovered MS formats in
comphelper/source/misc/docpasswordhelper.cxx,
package/source/xstor/owriteablestream.cxx,
package/source/xstor/owriteablestream.hxx,
package/source/xstor/xstorage.cxx, sfx2/source/appl/appopen.cxx.
- debian/patches/CVE-2020-12801-3.patch: use TypeDetection on load in
framework/source/services/autorecovery.cxx.
- CVE-2020-12801
* SECURITY UPDATE: file overwrite via forms
- debian/patches/CVE-2020-12803.patch: limit forms to http[s] in
forms/source/xforms/submission.cxx,
forms/source/xforms/submission/submission.hxx.
- CVE-2020-12803
* SECURITY UPDATE: Improper Certificate Validation vulnerability
- debian/patches/CVE-2022-26305.patch: compare authors using Thumbprint
in xmlsecurity/source/component/documentdigitalsignatures.cxx.
- CVE-2022-26305
* SECURITY UPDATE: stored passwords IV always the same
- debian/patches/CVE-2022-26306-pre1.patch: properly handle failure
decoding master password in
svl/source/passwordcontainer/passwordcontainer.cxx,
svl/source/passwordcontainer/passwordcontainer.hxx.
- debian/patches/CVE-2022-26306-1.patch: simplify Sequence iterations
in svl in svl/source/passwordcontainer/passwordcontainer.cxx.
- debian/patches/CVE-2022-26306-2.patch: add Initialization Vectors to
password storage in
officecfg/registry/schema/org/openoffice/Office/Common.xcs,
svl/source/passwordcontainer/passwordcontainer.cxx,
svl/source/passwordcontainer/passwordcontainer.hxx.
- CVE-2022-26306
* SECURITY UPDATE: password storage master key weak entropy
- debian/patches/CVE-2022-26307-1.patch: make hash encoding match
decoding in
officecfg/registry/schema/org/openoffice/Office/Common.xcs,
svl/source/passwordcontainer/passwordcontainer.cxx,
svl/source/passwordcontainer/passwordcontainer.hxx,
uui/source/iahndl-authentication.cxx.
- debian/patches/CVE-2022-26307-2.patch: add infobar to prompt to
refresh to replace old format in include/sfx2/strings.hrc,
include/sfx2/viewfrm.hxx, sfx2/source/view/viewfrm.cxx.
- CVE-2022-26307
* SECURITY UPDATE: arbitrary script execution via Office URI Schemes
- debian/patches/CVE-2022-3140-pre1.patch: warn on load when a document
binds an event to a macro in comphelper/source/misc/documentinfo.cxx,
dbaccess/source/core/dataaccess/ModelImpl.cxx,
dbaccess/source/core/dataaccess/databasedocument.cxx,
dbaccess/source/core/inc/ModelImpl.hxx,
include/comphelper/documentinfo.hxx, include/oox/ole/axcontrol.hxx,
include/sfx2/docmacromode.hxx, include/sfx2/objsh.hxx,
include/xmloff/xmlimp.hxx, oox/source/ole/vbaproject.cxx,
sc/source/filter/excel/xiescher.cxx,
sc/source/filter/inc/xiescher.hxx,
sc/source/ui/vba/vbasheetobject.cxx,
sc/source/ui/vba/vbasheetobject.hxx,
scripting/source/protocolhandler/scripthandler.cxx,
sfx2/source/doc/docmacromode.cxx, sfx2/source/doc/objmisc.cxx,
sfx2/source/doc/objstor.cxx, sfx2/source/doc/objxtor.cxx,
sfx2/source/doc/sfxbasemodel.cxx, sfx2/source/inc/objshimp.hxx,
sw/source/filter/html/htmlform.cxx,
sw/source/filter/html/htmlgrin.cxx, sw/source/filter/html/swhtml.cxx,
sw/source/filter/ww8/ww8par.cxx, sw/source/filter/ww8/ww8par.hxx,
sw/source/filter/ww8/ww8par5.cxx, xmloff/source/core/xmlimp.cxx,
xmloff/source/script/XMLEventImportHelper.cxx.
- debian/patches/CVE-2022-3140-1.patch: commands are always URLs in
wizards/source/access2base/DoCmd.xba.
- debian/patches/CVE-2022-3140-2.patch: filter out unwanted command
URIs in desktop/source/app/cmdlineargs.cxx.
- debian/patches/CVE-2022-3140-3.patch: check IFrame FrameURL target in
sfx2/source/appl/macroloader.cxx, sfx2/source/doc/iframe.cxx,
sfx2/source/inc/macroloader.hxx, sw/source/filter/html/htmlplug.cxx,
sw/source/filter/xml/xmltexti.cxx.
- debian/patches/CVE-2022-3140-4.patch: check impress/calc IFrame
FrameURL target in xmloff/source/draw/ximpshap.cxx.
- CVE-2022-3140
-- Marc Deslauriers <email address hidden> Thu, 13 Oct 2022 08:36:15 -0400
-
libreoffice (1:6.0.7-0ubuntu0.18.04.11) bionic-security; urgency=medium
* SECURITY UPDATE: Improper certificate validation
- debian/patches/CVE-2021-25636.patch: only use X509Data in
xmlsecurity/inc/xmlsec-wrapper.h,
xmlsecurity/source/xmlsec/mscrypt/xmlsignature_mscryptimpl.cxx,
xmlsecurity/source/xmlsec/nss/xmlsignature_nssimpl.cxx.
- CVE-2021-25636
-- Marc Deslauriers <email address hidden> Wed, 09 Mar 2022 06:50:02 -0500
-
libreoffice (1:6.0.7-0ubuntu0.18.04.10) bionic-security; urgency=medium
* SECURITY UPDATE: Unsafe URL assembly flaw in allowed script location check
- debian/patches/CVE-2019-9854.diff: assemble the parsed url describing a
script's location from the output of the preceding verification step.
- CVE-2019-9854
-- Marcus Tomlinson <email address hidden> Sat, 21 Sep 2019 13:44:15 +0200
-
libreoffice (1:6.0.7-0ubuntu0.18.04.9) bionic-security; urgency=medium
* SECURITY UPDATE: Insufficient URL validation allowing LibreLogo script execution
- debian/patches/CVE-2019-9850_1_2.diff: decode escape codes and ban scripts
with "LibreLogo" anywhere in its path.
- CVE-2019-9850
* SECURITY UPDATE: LibreLogo global-event script execution
- debian/patches/CVE-2019-9850_1_2.diff: catch more LibreLogo script executions
by expanding check to global events.
- CVE-2019-9851
* SECURITY UPDATE: Insufficient URL encoding flaw in allowed script location check
- debian/patches/CVE-2019-9850_1_2.diff: ensure that all URLs leaving
scriptURI2StorageUri() are percent-encoded.
- CVE-2019-9852
-- Marcus Tomlinson <email address hidden> Wed, 14 Aug 2019 15:15:42 +0100
-
libreoffice (1:6.0.7-0ubuntu0.18.04.8) bionic-security; urgency=medium
* SECURITY UPDATE: LibreLogo arbitrary script execution
- debian/patches/CVE-2019-9848.diff: don't allow LibreLogo to be used with
mouseover/etc dom-alike events.
- CVE-2019-9848
* SECURITY UPDATE: Remote bullet graphics retrieved in 'stealth mode'
- debian/patches/CVE-2019-9849.diff: include bullet graphics in 'stealth
mode' protection.
- CVE-2019-9849
-- Marcus Tomlinson <email address hidden> Tue, 16 Jul 2019 17:28:21 +0100
-
libreoffice (1:6.0.7-0ubuntu0.18.04.7) bionic; urgency=medium
* debian/patches/cpdmgr-check-dbus-desc.diff (LP: #1798074):
- Only create CPDManager if D-Bus descriptions present.
- Fixes LibreOffice startup crash when CPD packages installed.
-- Marcus Tomlinson <email address hidden> Fri, 31 May 2019 11:43:00 +0100
-
libreoffice (1:6.0.7-0ubuntu0.18.04.6) bionic; urgency=medium
[ Ikuya Awashiro ]
* debian/patches/new-japanese-era-name.patch (LP: #1827451):
Add new Japanse era name "Reiwa" support which taken from upstream:
https://cgit.freedesktop.org/libreoffice/core/commit/?id=cacbb0faef77ae8462de9ff5c7307a6a2e28b2bb
https://cgit.freedesktop.org/libreoffice/core/commit/?id=597c5d75b8e72d429e096535334eaac7973455ef
[ Olivier Tilloy ]
* debian/patches/java.vendor-Ubuntu.patch: update to also recognize
"Private Build" as java.vendor (for custom PPA builds) (LP: #1822839)
* debian/patches/java.vendor-Ubuntu.patch: also make jvmfwk recognize
"Ubuntu" as java.vendor (LP: #1822839)
[ Rene Engelhard ]
* debian/patches/java.vendor-Debian.diff: make jvmfwk recognize "Debian"
as java.vendor as that's what is set in openjdk 11 >= 11.0.3+4-2
- see #926009 (closes: #926318) (LP: #1822839)
* debian/control.gtk3.in:
- make libreoffice-gtk3 recommend gstreamer1.0-gtk3 (LP: #1820062)
-- Marcus Tomlinson <email address hidden> Tue, 07 May 2019 12:35:49 +0100
-
libreoffice (1:6.0.7-0ubuntu0.18.04.5) bionic; urgency=medium
* debian/patches/jdk-11.0.2-javadoc.diff: fix architecture-independent build
with OpenJDK 11 (debian bug #920331)
libreoffice (1:6.0.7-0ubuntu0.18.04.3) bionic-security; urgency=medium
* debian/patches/fix-tests-openjdk11.patch: fix ODK tests when running with
OpenJDK 11 (LP: #1814133)
-- Olivier Tilloy <email address hidden> Wed, 27 Feb 2019 12:11:27 +0100
-
libreoffice (1:6.0.7-0ubuntu0.18.04.4) bionic; urgency=medium
* debian/patches/jdk-11.0.2-javadoc.diff: fix architecture-independent build
with OpenJDK 11 (debian bug #920331)
-- Olivier Tilloy <email address hidden> Wed, 27 Feb 2019 12:11:27 +0100
-
libreoffice (1:6.0.7-0ubuntu0.18.04.2) bionic; urgency=medium
[ Rene Engelhard ]
* debian/patches/disableClassPathURLCheck.diff: add workaround to
fix build with openjdks with S8195874 included - add
-Djdk.net.URLClassPath.disableClassPathURLCheck=true to JAVAIFLAGS;
see https://gerrit.libreoffice.org/#/c/63118/2
libreoffice (1:6.0.7-0ubuntu0.18.04.1) bionic; urgency=medium
* New upstream release (LP: #1799230)
-- Olivier Tilloy <email address hidden> Tue, 27 Nov 2018 11:13:10 +0100
-
libreoffice (1:6.0.7-0ubuntu0.18.04.1) bionic; urgency=medium
* New upstream release (LP: #1799230)
-- Olivier Tilloy <email address hidden> Mon, 05 Nov 2018 17:08:27 +0100
-
libreoffice (1:6.0.6-0ubuntu0.18.04.1) bionic; urgency=medium
* New upstream release (LP: #1785679)
-- Olivier Tilloy <email address hidden> Thu, 30 Aug 2018 11:49:15 +0200
-
libreoffice (1:6.0.3-0ubuntu1) bionic; urgency=medium
* New upstream release
-- Olivier Tilloy <email address hidden> Tue, 10 Apr 2018 13:23:05 +0200
-
libreoffice (1:6.0.2-0ubuntu1) bionic; urgency=medium
[ Olivier Tilloy ]
* branding/progress.conf: update to new Ubuntu Orange (LP: #1752372)
[ Rico Tzschichholz ]
* New upstream release
* Drop upstreamed patches:
- apparmor-senddoc-fixes.patch
- fix-packageinfo-motarget-files.patch
- solenv-Update-gb_PackageInfo_emit_l10n_for_one_lang.patch
-- Olivier Tilloy <email address hidden> Mon, 05 Mar 2018 14:25:58 +0100
-
libreoffice (1:6.0.1-0ubuntu3) bionic; urgency=medium
[ Olivier Tilloy ]
* debian/patches/uitest-skip-test_text_direction.patch: removed
[ Rene Engelhard ]
* debian/patches/orcus-0.13.3.diff: backport patches to fix build/tests
against orcus 0.13.3
[ Rico Tzschichholz ]
* debian/patches/solenv-Update-gb_PackageInfo_emit_l10n_for_one_lang.patch:
Update gb_PackageInfo_emit_l10n_for_one_lang to add cjk_*, ctl_* and
ctlseqcheck_$LANG.xcd files to install list (LP: #1750335)
* Fix libvisio and libqxp shlibs dependency (Thanks Rene)
-- Olivier Tilloy <email address hidden> Fri, 23 Feb 2018 13:33:59 +0100
-
libreoffice (1:6.0.1-0ubuntu2) bionic; urgency=medium
[ Olivier Tilloy ]
* debian/patches/apparmor-senddoc-fixes.patch: updated to reflect upstream
commit
* debian/patches/uitest-skip-test_text_direction.patch: skip a UI test that
is consistently failing (LP: #1750335)
[ Rico Tzschichholz ]
* debian/rules: Revert "explicitly use openjdk 9 on i386…"
-- Olivier Tilloy <email address hidden> Wed, 21 Feb 2018 16:05:40 +0100
-
libreoffice (1:6.0.1-0ubuntu1) bionic; urgency=medium
[ Rico Tzschichholz ]
* New upstream release
* debian/patches/fix-packageinfo-motarget-files.patch: Fix make packageinfo
to let "install-packages-l10n-*" targets work again (LP: #1748437)
[ Olivier Tilloy ]
* debian/patches/hide-startcenter-and-maths-desktop-files.patch: hide
startcenter and math icons from the shell (LP: #1696250)
* debian/patches/apparmor-senddoc-fixes.patch: apparmor fixes for the
senddoc profile (LP: #1748895)
-- Olivier Tilloy <email address hidden> Tue, 13 Feb 2018 12:47:12 +0100
-
libreoffice (1:5.4.4-0ubuntu5) bionic; urgency=medium
* Don't build with system liborcus for now.
* Don't build with system glm for now.
-- Matthias Klose <email address hidden> Thu, 08 Feb 2018 20:06:45 +0100
-
libreoffice (1:5.4.4-0ubuntu4) bionic; urgency=medium
* Don't build with system liborcus for now.
-- Matthias Klose <email address hidden> Thu, 08 Feb 2018 19:27:19 +0100
-
libreoffice (1:5.4.4-0ubuntu3) bionic; urgency=medium
* No-change rebuild for libixion/liborcus soname changes.
-- Matthias Klose <email address hidden> Fri, 02 Feb 2018 17:50:56 +0100
-
libreoffice (1:5.4.4-0ubuntu2) bionic; urgency=medium
[ Olivier Tilloy ]
* New upstream release
* debian/patches/apparmor-profiles-comments.patch: added
(https://bugs.documentfoundation.org/show_bug.cgi?id=114915)
* debian/patches/apparmor-allow-jvm-execution.patch: added
(https://bugs.documentfoundation.org/show_bug.cgi?id=115208)
[ Rene Engelhard ]
* debian/rules, debian/libreoffice-common.maintscript: fix path in
apparmor profiles (add missing /). mv_conffile the files to the new
name...
* debian/patches/poppler-0.62.diff: backport from master to fix build with
poppler 0.62
[ Rico Tzschichholz ]
* debian/rules: update source location of fc_local.conf
-- Olivier Tilloy <email address hidden> Fri, 26 Jan 2018 11:30:46 +0100
-
libreoffice (1:5.4.3-0ubuntu2) bionic; urgency=medium
* No-change rebuild for poppler soname change.
-- Matthias Klose <email address hidden> Thu, 25 Jan 2018 06:29:53 +0000
-
libreoffice (1:5.4.3-0ubuntu1) bionic; urgency=medium
* New upstream release
* debian/patches/icu-60-fixes.patch: refreshed
-- Olivier Tilloy <email address hidden> Wed, 22 Nov 2017 21:49:34 +0100
-
libreoffice (1:5.4.2-0ubuntu5) bionic; urgency=medium
* debian/patches/icu-60-fixes.patch: added
(https://bugs.documentfoundation.org/show_bug.cgi?id=113705)
* debian/patches/skip-testLineBreaking-icu60.patch: removed, no longer needed
-- Olivier Tilloy <email address hidden> Mon, 20 Nov 2017 11:18:19 +0100
-
libreoffice (1:5.4.2-0ubuntu4) bionic; urgency=medium
[ Rene Engelhard ]
* debian/patches/disable-flaky-tests.diff: disable chart2_dump test
* debian/patches/ww8export-HAVE_MORE_FONTS.diff: temporarily(?) disable
testTableKeep test, fails with --without-fonts even though Liberation
is in Build-Depends:...
[ Olivier Tilloy ]
* debian/patches/skip-testLineBreaking-icu60.patch: temporarily skip
failing unit test with ICU 60
-- Olivier Tilloy <email address hidden> Mon, 13 Nov 2017 13:16:45 +0100
-
libreoffice (1:5.4.2-0ubuntu3) bionic; urgency=medium
[ Rene Engelhard ]
* debian/patches/disable-flaky-tests.diff: disable chart2_dump test
* debian/patches/ww8export-HAVE_MORE_FONTS.diff: temporarily(?) disable
testTableKeep test, fails with --without-fonts even though Liberation
is in Build-Depends:...
-- Olivier Tilloy <email address hidden> Tue, 07 Nov 2017 08:19:15 +0100
-
libreoffice (1:5.4.2-0ubuntu2) bionic; urgency=medium
[ Rene Engelhard ]
* debian/patches/icu-no-icu-config.diff: don't use icu-config for
determining the ICU version; doesn't exist in (Debian's) ICU 59.1 anymore
[ Rico Tzschichholz ]
* debian/rules: Rely on -Npackage in DEBHELPER_OPTIONS to fix debhelper error
-- Olivier Tilloy <email address hidden> Thu, 02 Nov 2017 15:58:36 +0100
-
libreoffice (1:5.4.1-0ubuntu3) bionic; urgency=medium
* debian/rules: Stop referencing libreoffice-sdbc-firebird, which isn't
in debian/control, as the new debhelper really doesn't like that.
-- Adam Conrad <email address hidden> Sat, 28 Oct 2017 03:23:50 -0600
-
libreoffice (1:5.4.1-0ubuntu2) bionic; urgency=medium
* No-change rebuild for libicu soname change.
-- Matthias Klose <email address hidden> Wed, 25 Oct 2017 15:43:24 +0000
-
libreoffice (1:5.4.1-0ubuntu1) artful; urgency=medium
[ Olivier Tilloy ]
* debian/rules: move usr/lib/libreoffice/sdk/settings/dk.mk from
libreoffice-dev-common to libreoffice-dev (LP: #1712873)
[ Rico Tzschichholz ]
* New upstream release
* Drop lo-xlate-lang-update.diff, add-libebook-1.2.so.19-in-EApi.cxx.patch,
examples-fix-SDK_AUTO_DEPLOYMENT-check.diff, applied upstream
[ Rene Engelhard ]
* debian/patches/stop-shipping-mimelnk-desktop-files.diff: as name says
(closes: #872001)
* debian/patches/java9.diff: backport Java 9 patch from master
* debian/rules:
- run dh_strip_nondeterminism
- set locale to en-US.UTF-8 also for make check, the dbaccess tests
fail in some frenchy locale...
- move pagein-{calc,draw,impress,writer} to their respective packages
* debian/scripts/gid2pkgdirs.sh: fix move of types/*.rdb and services/*.rdb
to core and move pagein-common there too. They reference libmergedlo.so
which doesn't exist on all archs (closes: #873443)
-- Olivier Tilloy <email address hidden> Fri, 01 Sep 2017 07:25:31 +0200