Improper Certificate Validation Affecting autocorr-es package, versions <1:6.4.7.2-10.0.1.el8


Severity

Recommended
medium

Based on Oracle Linux security rating

    Threat Intelligence

    EPSS
    0.11% (44th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-ORACLE8-AUTOCORRES-2831469
  • published 18 May 2022
  • disclosed 12 Oct 2021

How to fix?

Upgrade Oracle:8 autocorr-es to version 1:6.4.7.2-10.0.1.el8 or higher.
This issue was patched in ELSA-2022-1766.

NVD Description

Note: Versions mentioned in the description apply only to the upstream autocorr-es package and not the autocorr-es package as distributed by Oracle. See How to fix? for Oracle:8 relevant fixed versions and status.

LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurred since the last signing and that the signature is valid. An Improper Certificate Validation vulnerability in LibreOffice allowed an attacker to modify a digitally signed ODF document to insert an additional signing time timestamp which LibreOffice would incorrectly present as a valid signature signed at the bogus signing time. This issue affects: The Document Foundation LibreOffice 7-0 versions prior to 7.0.6; 7-1 versions prior to 7.1.2.

CVSS Scores

version 3.1
Expand this section

NVD

7.5 high
  • Attack Vector (AV)
    Network
  • Attack Complexity (AC)
    Low
  • Privileges Required (PR)
    None
  • User Interaction (UI)
    None
  • Scope (S)
    Unchanged
  • Confidentiality (C)
    None
  • Integrity (I)
    High
  • Availability (A)
    None
Expand this section

Red Hat

7.1 high