The remote SUSE Linux SLED12 / SLED_SAP12 / SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:3576-1 advisory.

    libreoffice was updated to version 24.8.1.2 (jsc#PED-10362):

    - Release notes:

      * https://wiki.documentfoundation.org/Releases/24.8.0/RC1 and
      * https://wiki.documentfoundation.org/Releases/24.8.0/RC2 and
      * https://wiki.documentfoundation.org/Releases/24.8.0/RC3

    - Security issues fixed:

      * CVE-2024-526: Fixed TLS certificates are not properly verified when utilizing LibreOfficeKit     (bsc#1226975)

    - Other bugs fixed:

      * Use system curl instead of the bundled one on systems greater than or equal to SLE15 (bsc#1229589)
      * Use the new clucene function, which makes index files reproducible (bsc#1047218)

    - Update bundled dependencies:

      * Java-Websocket updated from 1.5.4 to 1.5.6
      * boost updated from 1.82.0 to 1.85.0
      * curl updated from 8.7.1 to 8.9.1
      * fontconfig updated from 2.14.2 to 2.15.0
      * freetype updated from 2.13.0 to 2.13.2
      * harfbuzz updated from 8.2.2 to 8.5.0
      * icu4c-data updated from 73.2 to 74.2
      * icu4c-src updated from 73.2 to 74.2
      * libassuan updated from 2.5.7 to 3.0.1
      * libcmis updated from 0.6.1 to 0.6.2
      * libgpg-error updated from 1.48 to 1.50
      * pdfium updated from 6179 to 6425
      * poppler updated from 23.09.0 to 24.08.0
      * tiff updated from 4.6.0 to 4.6.0t

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:3577-1 advisory.

    libreoffice was updated to version 24.8.1.2 (jsc#PED-10362):

    - Release notes:

      * https://wiki.documentfoundation.org/Releases/24.8.0/RC1 and
      * https://wiki.documentfoundation.org/Releases/24.8.0/RC2 and
      * https://wiki.documentfoundation.org/Releases/24.8.0/RC3

    - Security issues fixed:

      * CVE-2024-526: Fixed TLS certificates are not properly verified when utilizing LibreOfficeKit     (bsc#1226975)

    - Other bugs fixed:

      * Use system curl instead of the bundled one on systems greater than or equal to SLE15 (bsc#1229589)
      * Use the new clucene function, which makes index files reproducible (bsc#1047218)
      * Support firebird database with new package `libreoffice-base-drivers-firebird` in Package Hub and         openSUSE Leap (bsc#1225597)

    - Update bundled dependencies:

      * Java-Websocket updated from 1.5.4 to 1.5.6
      * boost updated from 1.82.0 to 1.85.0
      * curl updated from 8.7.1 to 8.9.1
      * fontconfig updated from 2.14.2 to 2.15.0
      * freetype updated from 2.13.0 to 2.13.2
      * harfbuzz updated from 8.2.2 to 8.5.0
      * icu4c-data updated from 73.2 to 74.2
      * icu4c-src updated from 73.2 to 74.2
      * libassuan updated from 2.5.7 to 3.0.1
      * libcmis updated from 0.6.1 to 0.6.2
      * libgpg-error updated from 1.48 to 1.50
      * pdfium updated from 6179 to 6425
      * poppler updated from 23.09.0 to 24.08.0
      * tiff updated from 4.6.0 to 4.6.0t

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 23.10 / 24.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-6877-1 advisory.

    It was discovered that LibreOffice incorrectly performed TLS certificate verification when the     LibreOfficeKit library is being used by third-party components. A remote attacker could possibly use this     issue to obtain sensitive information.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

远程 Ubuntu 23.10 / 24.04 LTS 主机上安装的程序包受到 USN-6877-1 公告中提及的一个漏洞影响。

    发现当第三方组件使用 LibreOfficeKit 库时，LibreOffice 未能正确执行 TLS 证书验证。远程攻击者可能利用此问题来获取敏感信息。

Tenable 已直接从 Ubuntu 安全公告中提取上述描述块。

请注意，Nessus 尚未测试此问题，而是只依据应用程序自我报告的版本号进行判断。

遠端 Ubuntu 23.10 / 24.04 LTS 主機上安裝的套件受到 USN-6877-1 公告中所提及的一個弱點影響。

    據發現，當第三方元件使用 LibreOfficeKit 程式庫時，LibreOffice 未正確執行 TLS 憑證驗證。遠端攻擊者可能利用此問題取得敏感資訊。

Tenable 已直接從 Ubuntu 安全公告擷取前置描述區塊。

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

リモートの Ubuntu 23.10/24.04 LTS ホストには、USN-6877-1 のアドバイザリに記載された脆弱性の影響を受けるパッケージがインストールされています。

    LibreOfficeKit ライブラリがサードパーティのコンポーネントによって使用されているとき、LibreOffice が TLS 証明書の検証を不適切に実行することがわかりました。リモートの攻撃者がこの問題を悪用して、秘密情報を取得する可能性があります。

Tenable は、前述の説明ブロックを Ubuntu セキュリティアドバイザリからすでに直接抽出しています。

Nessus はこの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

ID	名稱	產品	系列	已發布	已更新	嚴重性
208716	SUSE SLED12 / SLES12 Security Update : libreoffice (SUSE-SU-2024:3576-1)	Nessus	SuSE Local Security Checks	2024/10/11	2024/10/11	high
208721	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : libreoffice (SUSE-SU-2024:3577-1)	Nessus	SuSE Local Security Checks	2024/10/11	2024/10/11	high
201890	Ubuntu 23.10 / 24.04 LTS : LibreOffice vulnerability (USN-6877-1)	Nessus	Ubuntu Local Security Checks	2024/7/4	2024/9/18	high
201890	Ubuntu 23.10 / 24.04 LTS：LibreOffice 漏洞 (USN-6877-1)	Nessus	Ubuntu Local Security Checks	2024/7/4	2024/9/18	high
201890	Ubuntu 23.10 / 24.04 LTS：LibreOffice 弱點 (USN-6877-1)	Nessus	Ubuntu Local Security Checks	2024/7/4	2024/9/18	high
201890	Ubuntu 23.10/24.04 LTS: LibreOffice の脆弱性 (USN-6877-1)	Nessus	Ubuntu Local Security Checks	2024/7/4	2024/9/18	high

偵測

搜尋 Plugin

high

high

high

high

high

high