File _patchinfo of Package patchinfo.7403

<patchinfo incident="7403">
  <issue tracker="bnc" id="1089706">VUL-0: CVE-2018-10120: libreoffice: The SwCTBWrapper::Read function in sw/source/filter/ww8/ww8toolbar.cxx inLibreOffice before 5.4.6.1 and 6.x before 6.0.2.1 does not validate acustomizations index, which allows remote attackers to cause</issue>
  <issue tracker="bnc" id="1090737">libreoffice requires update-desktop-files at runtime</issue>
  <issue tracker="bnc" id="915996">LibreOffice doesn't show internal Help</issue>
  <issue tracker="bnc" id="1091772">[staging] FTBFS: libreoffice fails to build against icu 61.1</issue>
  <issue tracker="bnc" id="1089705">VUL-0: CVE-2018-10119: libreoffice: sot/source/sdstor/stgstrms.cxx in LibreOffice before 5.4.5.1 and 6.x before6.0.1.1 uses an incorrect integer data type in the StgSmallStrm class, whichallows remote attackers to cause a denial of servic</issue>
  <issue tracker="cve" id="2018-10120"/>
  <issue tracker="cve" id="2018-10119"/>
  <category>security</category>
  <rating>moderate</rating>
  <packager>scarabeus_iv</packager>
  <description>

This update for libreoffice to 6.0.4.2 fixes lots of bugs and also the following issues:

Security issues fixed:

- CVE-2018-10120: The SwCTBWrapper::Read function in sw/source/filter/ww8/ww8toolbar.cxx did not validate a customizations index, which allowed remote attackers to cause a denial of service (heap-based buffer overflow with write access) or possibly have unspecified other impact via a crafted document that contains a certain Microsoft Word record. (bsc#1089706)
- CVE-2018-10119: sot/source/sdstor/stgstrms.cxx used an incorrect integer data type in the StgSmallStrm class, which allowed remote attackers to cause a denial of service (use-after-free with write access) or possibly have unspecified other impact via a crafted document that uses the structured storage ole2 wrapper file format.  (bsc#1089705)

Other issues fixed:

- DOCX import: missing table background color
- Bring back offline help per popular demand as lto saves space
  we could use with it bsc#915996

</description>
  <summary>Security update for libreoffice</summary>
</patchinfo>