Pambuyo pa miyezi isanu yachitukuko ndi zaka zisanu ndi ziwiri ndi theka kuchokera pamene adatulutsidwa komaliza, kumasulidwa kwa ofesi ya Apache OpenOffice 4.1.11 kunapangidwa, yomwe inakonza zokonza 12. Maphukusi okonzeka amakonzekera Linux, Windows ndi macOS.
Kutulutsidwa kwatsopano kumakonza zovuta zitatu:
- CVE-2021-33035 - Imalola kugwiritsa ntchito ma code mukatsegula fayilo yopangidwa mwapadera ya DBF. Vutoli limayamba chifukwa OpenOffice kudalira fieldLength ndi fieldType values ββpamutu wa mafayilo a DBF kugawa kukumbukira, osayang'ana kuti mtundu weniweni wa data m'magawowo umagwirizana. Kuti muchite chiwembu, mutha kufotokozera mtundu wa INTEGER pamundaType mtengo, koma ikani deta yokulirapo ndikuwonetsa mtengo wamundaUtali womwe sukugwirizana ndi kukula kwa datayo ndi mtundu wa INTEGER, zomwe zidzatsogolera ku mchira wa datayo. kuchokera m'munda wolembedwa kupyola buffer yomwe yaperekedwa. Chifukwa cha kusefukira kwa buffer komwe kumayendetsedwa, mutha kutanthauziranso cholozera chobwerera kuchokera ku ntchitoyi ndipo, pogwiritsa ntchito njira zopangira mapulogalamu obwerera (ROP - Return-Oriented Programming), kukwaniritsa kukhazikitsidwa kwa code yanu.
- CVE-2021-40439 ndikuwukira kwa DoS "Biliyoni kuseka" (bomba la XML), komwe kumabweretsa kutopa kwazinthu zomwe zilipo pokonza chikalata chopangidwa mwapadera.
- CVE-2021-28129 - Zomwe zili mu phukusi la DEB zidayikidwa pamakina ngati osagwiritsa ntchito mizu.
Zosintha zopanda chitetezo:
- Kukula kwa zilembo m'malemba a gawo lothandizira awonjezedwa.
- Chinthu chawonjezedwa ku Insert menyu kuti muwongolere zovuta zamafonti a Fontwork.
- Onjezani chithunzi chomwe chikusowa pamenyu Fayilo ya ntchito yotumiza kunja kwa PDF.
- Vuto lakutayika kwa zithunzi mukasunga mumtundu wa ODS lathetsedwa.
- Nkhani yokhala ndi magwiridwe antchito ena otsekeredwa ndi mawu otsimikizira opareshoni omwe adawonjezedwa m'chikalata cham'mbuyomu yathetsedwa (mwachitsanzo, zokambiranazo zidawonetsedwa pofotokoza gawo lachikalata chomwechi).
Source: opennet.ru