-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Tue, 21 Jul 2026 13:41:22 -0300
Source: libreoffice
Architecture: source
Version: 4:25.2.3-2+deb13u7
Distribution: trixie-security
Urgency: medium
Maintainer: Debian LibreOffice Maintainers <debian-openoffice@lists.debian.org>
Changed-By: Rene Engelhard <rene@debian.org>
Changes:
libreoffice (4:25.2.3-2+deb13u7) trixie-security; urgency=medium
.
* debian/patches/CVE-2026-62327?.diff: fix
- CVE-2026-63272 WMF DX-array heap OOB (CRFDC4JM)
- CVE-2026-63273 PDF decrypt-key OOB write (J00S1S9Y)
- CVE-2026-63274 PDF /Length stream OOB (QT406EDT)
- CVE-2026-63275 CFF addHints stack OOB (RNHRV8B9)
- CVE-2026-63276 CFF-to-Type1 stack OOB (YA6ADR86)
- CVE-2026-63278 environment / ini-file disclosure
(CVE-2024-12426 bypass)
- CVE-2026-63279 PICT palette-index heap OOB read
Checksums-Sha1:
f58b7090d8768c03480dd711f3a376388e235c3c 36665 libreoffice_25.2.3-2+deb13u7.dsc
49702b91528b9a85a55730b8bdb371849acb1e44 28312512 libreoffice_25.2.3-2+deb13u7.debian.tar.xz
ad1ccfa4e7e9c085f3005885013dc741909d444e 28420 libreoffice_25.2.3-2+deb13u7_source.buildinfo
Checksums-Sha256:
d150d3bdd9f0b8cdb97cdad99a85cfac4f008cd409e310d76560e2b90ba9373a 36665 libreoffice_25.2.3-2+deb13u7.dsc
1c3edac2aa81945e2973632878e67054dc929e0fd22e9e5150ef86d7961a287c 28312512 libreoffice_25.2.3-2+deb13u7.debian.tar.xz
7fc24341161596e16cff0fa8cf7ddde5fed70555b1a8e20a08071ad7c3a4d540 28420 libreoffice_25.2.3-2+deb13u7_source.buildinfo
Files:
eb94e555ad10e773810bf53e09268c07 36665 editors optional libreoffice_25.2.3-2+deb13u7.dsc
c707ed7c81720687b44a92e4f0688942 28312512 editors optional libreoffice_25.2.3-2+deb13u7.debian.tar.xz
a05f514e09a67429524904b6a1ffcd07 28420 editors optional libreoffice_25.2.3-2+deb13u7_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQJEBAEBCgAuFiEE4S3qRnUGcM+pYIAdCqBFcdA+PnAFAmq0Lg4QHHJlbmVAZGVi
aWFuLm9yZwAKCRAKoEVx0D4+cLvqD/0YH8DOYK2PhfqHZNDtNQwAyLT4dri3Awma
RiLvlkoO/5MnOsht411u7PLWIrhu4aqyQP7Cm7rT6bM1ZftEaYnjtwbxDmRL5No0
7GeaW0gN72Mw3VMVUZfvAookp4EM7X9mJkKIIvn6M1UbfRzno9olF1SQriitA1sa
r5LZ/Bgli3TDDJhVtuZ4+vl6s/E+Milkjl8LNCpo55W74GIv3F9nRJpi25JNgfri
ZqdtcbQpwbM328YuqwxxP29AbfzRqCA50EET1Af13klbZEulox6M9vS/TPA1sW6P
AN99D+Q026ja3h8hGHBTmMqvF1dtLbGqmF07+rPuXHKP9nHekT+QHOwIIb9GqZ8M
T8lQz86pDioMaeiOp6MjhOacvHWPM2xnGh7BTfRVKV1dT7nEmDFQL1cAMtIkygdz
jeA9xyWFgTa6wm5Wv8b2yC3HL++z/IP7Ee6M4UCdPC3kmZt2+lLJBqH3F9QYK2vU
nLfPP15+yZfkoHZ+afBNyENm3bCrzkkBPLn89kB99sQ3NeV8gmlVWO6glvGWppn4
OldrAyNWZvRpbNfc90JLQcqchgGM7UiiYJSdYS12Ou6a2OYU4Ss8MCJo4PitQ1PN
BL55CphHGCYf7XeNSslZvMtbSNHkNZ0sO1z2kHN0iPb3tH+bbdKsChJZgmqUtV1N
E3sjVvYFyw==
=Zgjb
-----END PGP SIGNATURE-----
