♞ Coming up on 9TO5Linux ♞ The Document Foundation
announced today the release and general availability of the LibreOffice
7.2.4 and LibreOffice 7.1.8 updates that address an important security vulnerability.
Released a month earlier than expected, LibreOffice 7.2.4 is now available for download
along with LibreOffice 7.1.8, an unplanned release in the LibreOffice 7.1 series of the popular,
free and open-source office suite, which reached end of life on November 30th, 2021.
Both releases include a fix for a buffer heap overflow vulnerability, namely CVE-2021-43527,
which is a remote code execution flaw discovered in the way Mozilla’s NSS (Network Security
Services) component verifies certificates. The issue affects email clients and PDF viewers
that use NSS for verifying signatures encoded within CMS, S/MIME, PKCS #7, or PKCS #12, such
as LibreOffice, Evolution, Evince, and Mozilla Thunderbird, and it could allow an attacker posing
as an SSL/TLS server to send a malicious certificate to obtain sensitive information.
This is a major memory corruption flaw in NSS, almost any use of NSS is affected.
“All LibreOffice users are recommended to update their installation. Both new version
include the fixed NSS 3.73.0 cryptographic library, to solve CVE-2021-43527,”
Users of the LibreOffice 7.2 and 7.1 office suite series, as well as users of the Mozilla
Thunderbird, Evolution, and Evince apps, and other apps that use the NSS component are urged
to update their installations as soon as possible to the latest versions of these software.
You can download LibreOffice 7.2.4 and 7.1.8 right now from the official website as DEB or
RPM binaries for Debian/Ubuntu-based or Red Hat-based distributions.
If you have LibreOffice installed from the software repositories
of your GNU/Linux distribution, it is highly recommended that you update your installations
from there rather than installing the binaries provided by The Document Foundation.
The NSS component could be used by other applications, so make sure that you keep
your installations up to date at all times to avoid security threats or system instability.
:: More :: LibreOffice 7.2.4 arrives alongside 7.1.8 earlier
than expected with a major security patch When a software update is released, most of us
expect new features to be announced, but more frequent versions are released to fix bugs.
Many of these patches improve the user experience, but they are no more important
than those that improve security. And that's what The Document Foundation announced today:
both LibreOffice 7.2.4 como 7.1.8 they have been launched including a major security patch.
Both versions have been released ahead of time, but because TDF has corrected
the bug CVE-2021-43527 that affected the cryptographic library NSS 3.73.0. That is
the only change they have made in LibreOffice 7.2.4 and 7.1.8, and, although they do not
give details about how it would affect users, they have considered it serious enough for the releases
to be advanced and for the recommended version You have reached your eighth point update.
LibreOffice 7.2.4 and 7.1.8 fix bug CVE-2021-43527
Not even Miter, who collects and publishes information on this type of security flaw (CVE),
provides information about it. Therefore, we only know what The Document Foundation tells us:
“The Document Foundation announces the LibreOffice 7.2.4 Community
and the LibreOffice 7.1.8 Community to provide a key security fix. […] The two new versions
include the corrected NSS 3.73.0 cryptographic library, to solve the CVE-2021-43527
(the nss secfix is ​​the only change compared to the previous version) ».
Once again, they have taken the opportunity to remind us that what they launch to the public is
the community version (Community), and that if we want improved support and special functions
we have to subscribe to the version for companies (Enterprise). They also mention again that,
as former, this version is available for Apple Silicon computers.
LibreOffice 7.2.4 and 7.1.8 are already available from the project download page.
LibreOffice 7.1.8 continues to be recommended for production teams, and will continue to do so until
at least the release of LO 7.2.5. :: More ::
LibreOffice 7.2.4 and 7.1.8 community editions announced
The Document Foundation (TDF) announced ahead of schedule the community version 7.1.8 with
LibreOffice 7.2.4 community release to provide a major security fix . As it will be remembered,
the 7.1 series actually came to the end of its life with the announcement of the 7.1.7 version
and was announced on the versions page of the 7.1 series . According to the release
calendar of the community version of LibreOffice 7.2.4, the release date of the stable version
seemed to be January 3-9. According to the announcement made by Italo Vignoli
on blog.documentfoundation.org; In order to provide an important security fix,
LibreOffice 7.2.4 community version was announced ahead of schedule, again 7.1.8 community version
from 7.1 series. All LibreOffice users are advised to update their installation. Both
new versions include the fixed NSS 3.73.0 encryption library to resolve CVE-2021-43527.
It is said that the only change compared to the previous version is nss
secfix. For more detailed information about the community versions of LibreOffice 7.2.4 and 7.1.8,
you can review the release announcement . Thanks for watching,
I hope you enjoyed this video, If you did hit that thumbs up button, it helps
me to make good content for you, other then that, I will see you in tomorrow's video, peace out.