Embedded Objects in writer and calc can contain previews of their content. A document can be crafted which contains an embedded object that is a link to an existing file on the targets system. On load the preview of the embedded object will be updated to reflect the content of the file on the target system. In the case of LibreOffice used as an online service that preview of data on the target system could be used to expose details of the environment LibreOffice is running in. In the case of LibreOffice as a standard desktop application, the preview could be concealed in hidden sections and retrieved by the attacker if the document is saved and returned to sender. External References: http://www.libreoffice.org/about-us/security/advisories/cve-2017-3157/
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2017:0914 https://access.redhat.com/errata/RHSA-2017:0914
This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Via RHSA-2017:0979 https://access.redhat.com/errata/RHSA-2017:0979
this update appears to cause issues on libreoffice 4.3 / el6. for example: * create a writer document * insert a formula * save and close the document * open the saved document in writer * edit the formula * the formula preview is replaced by 'object 1'. i also tested impress, which also seems to have issues, but just doesn't display anything, rather than 'object 1'. the formulas do seem to remain editable, though while testing, i think i managed to get to a state where this was not the case ... things seem to work o.k. on libreoffice 5 / el7. thanks, richard