Kamora likhoeli tse hlano tsa nts'etsopele le lilemo tse supileng le halofo ho tloha tokollong ea ho qetela ea bohlokoa, tokollo ea tokiso ea ofisi ea Apache OpenOffice 4.1.11 e thehiloe, e sisintseng litokiso tse 12. Liphutheloana tse seng li entsoe li lokiselitsoe Linux, Windows le macOS.
Tokollo e ncha e lokisa mefokolo e meraro:
- CVE-2021-33035 - E lumella ts'ebetso ea khoutu ha o bula faele ea DBF e entsoeng ka mokhoa o ikhethileng. Bothata bo bakoa ke OpenOffice e itšetlehileng ka lebalaLength le fieldType boleng lihloohong tsa lifaele tsa DBF ho fana ka mohopolo, ntle le ho hlahloba hore na mofuta oa sebele oa data masimong o lumellana. Ho etsa tlhaselo, o ka hlakisa mofuta oa INTEGER tšimongMofuta oa boleng, empa beha data e kholoanyane 'me u hlalose sebaka sa Bolelele bo sa tsamaellaneng le boholo ba data le mofuta oa INTEGER, e tla lebisa mohatleng oa data. ho tsoa lebaleng le ngoloang ka nqane ho buffer e abetsoeng. Ka lebaka la ho phalla ha buffer e laoloang, o ka hlalosa hape "pointer pointer" ho tloha ts'ebetsong 'me, ka ho sebelisa mekhoa ea ho khutlela morao (ROP - Return-Oriented Programming), finyella ts'ebetsong ea khoutu ea hau.
- CVE-2021-40439 ke tlhaselo ea DoS ea "Lilione tse limilione tse tšehang" (bomo ea XML), e lebisang mothating oa lisebelisoa tse fumanehang tsa sistimi ha o sebetsana le tokomane e entsoeng ka ho khetheha.
- CVE-2021-28129 - Likahare tsa sephutheloana sa DEB li kentsoe tsamaisong joalo ka mosebelisi eo e seng motso.
Liphetoho tseo e seng tsa ts'ireletso:
- Boholo ba litlhaku karolong ea thuso bo ekelitsoe.
- Ntho e kentsoe ho Insert menu ho laola liphello tsa Fontwork fonts.
- E kentse lets'oao le sieo ho menyu ea Faele bakeng sa ts'ebetso ea thomello ea PDF.
- Bothata ba tahlehelo ea litšoantšo ha u boloka ka sebopeho sa ODS bo rarollotsoe.
- Taba e nang le ts'ebetso e 'ngoe ea bohlokoa e koetsoeng ke puisano ea netefatso ea ts'ebetso e kentsoeng tokollong e fetileng e rarollotsoe (mohlala, puisano e hlahisitsoe ha ho buuwa ka karolo tokomaneng e le nngwe).
Source: opennet.ru