The version of Apple iTunes running on the remote host is prior to 12.3. It is, therefore, affected by multiple vulnerabilities in the WebKit, CoreText, and ICU components, and in the bundled version of the Microsoft Visual Studio C++ Redistributable Package. An attacker can exploit these vulnerabilities to cause a denial of service, execute arbitrary code, or gain access to encrypted SMB credentials.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Apple iTunes installed on the remote Windows host is prior to 12.3. It is, therefore, affected by multiple vulnerabilities in the bundled versions of WebKit, CoreText, the Microsoft Visual Studio C++ Redistributable Package, and ICU.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update brings LibreOffice to version 5.0.4, a major version update.

It brings lots of new features, bug fixes and also security fixes.

Features as seen on http://www.libreoffice.org/discover/new-features/

  - LibreOffice 5.0 ships an impressive number of new     features for its spreadsheet module, Calc: complex     formulae image cropping, new functions, more powerful     conditional formatting, table addressing and much more.
    Calc's blend of performance and features makes it an     enterprise-ready, heavy duty spreadsheet application     capable of handling all kinds of workload for an     impressive range of use cases

  - New icons, major improvements to menus and sidebar : no     other LibreOffice version has looked that good and     helped you be creative and get things done the right     way. In addition, style management is now more intuitive     thanks to the visualization of styles right in the     interface.

  - LibreOffice 5 ships with numerous improvements to     document import and export filters for MS Office, PDF,     RTF, and more. You can now timestamp PDF documents     generated with LibreOffice and enjoy enhanced document     conversion fidelity all around.

The Pentaho Flow Reporting Engine is now added and used.

Security issues fixed :

  - CVE-2014-8146: The resolveImplicitLevels function in     common/ubidi.c in the Unicode Bidirectional Algorithm     implementation in ICU4C in International Components for     Unicode (ICU) before 55.1 did not properly track     directionally isolated pieces of text, which allowed     remote attackers to cause a denial of service     (heap-based buffer overflow) or possibly execute     arbitrary code via crafted text.

  - CVE-2014-8147: The resolveImplicitLevels function in     common/ubidi.c in the Unicode Bidirectional Algorithm     implementation in ICU4C in International Components for     Unicode (ICU) before 55.1 used an integer data type that     is inconsistent with a header file, which allowed remote     attackers to cause a denial of service (incorrect malloc     followed by invalid free) or possibly execute arbitrary     code via crafted text.

  - CVE-2015-4551: An arbitrary file disclosure     vulnerability in Libreoffice and Openoffice Calc and     Writer was fixed.

  - CVE-2015-5212: A LibreOffice 'PrinterSetup Length'     integer underflow vulnerability could be used by     attackers supplying documents to execute code as the     user opening the document.

  - CVE-2015-5213: A LibreOffice 'Piece Table Counter'     invalid check design error vulnerability allowed     attackers supplying documents to execute code as the     user opening the document.

  - CVE-2015-5214: Multiple Vendor LibreOffice Bookmark     Status Memory Corruption Vulnerability allowed attackers     supplying documents to execute code as the user opening     the document.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for LibreOffice and some library dependencies (cmis-client, libetonyek, libmwaw, libodfgen, libpagemaker, libreoffice-share-linker, mdds, libwps) fixes the following issues :

Changes in libreoffice :

  - Provide l10n-pt from pt-PT

  - boo#945047 - LO-L3: LO is duplicating master pages,     extended fix

  - boo#951579 - LO-L3: [LibreOffice] Calc 5.0 fails to open     ods files

  - deleted RPATH prevented loading of bundled 3rd party RDF     handler libs

  - Version update to 5.0.4.2 :

  - Final of the 5.0.4 series

  - boo#945047 - LO-L3: LO is duplicating master pages

  - Version update to 5.0.4.1 :

  - rc1 of 5.0.4 with various regression fixes

  - boo#954345 - LO-L3: Insert-->Image-->Insert as Link     hangs writer

  - Version update to 5.0.3.2 :

  - Final tag of 5.0.3 release

  - Fix boo#939996 - LO-L3: Some bits from DOCX file are not     imported

  - Fix boo#889755 - LO-L3: PPTX: chart axis number format     incorrect

  - boo#679938 - LO-L3: saving to doc file the chapter name     in the header does not change with chapters

  - Version update to 5.0.3RC1 as it should fix i586 test     failure

  - Update text2number extension to 1.5.0

  - obsolete libreoffice-mono

  - pentaho-flow-reporting require is conditional on     system_libs

  - Update icon theme dependencies

  - https://lists.debian.org/debian-openoffice/2015/09/msg00343.html

  - Version bump to 5.0.2 final fate#318856 fate#319071     boo#943075 boo#945692 :

  - Small tweaks compared to rc1

  - For sake of completion this release also contains     security fixes for boo#910806 CVE-2014-8147, boo#907636     CVE-2014-9093, boo#934423 CVE-2015-4551, boo#910805     CVE-2014-8146, boo#940838 CVE-2015-5214, boo#936190     CVE-2015-5213, boo#936188 CVE-2015-5212, boo#934423     CVE-2015-45513, boo#934423 CVE-2015-4551, boo#910805     CVE-2014-8146, boo#940838 CVE-2015-5214, boo#936190     CVE-2015-5213, boo#936188 CVE-2015-5212, boo#934423     CVE-2015-45513, boo#934423 CVE-2015-4551, boo#910805     CVE-2014-8146, boo#940838 CVE-2015-5214, boo#936190     CVE-2015-5213, boo#936188 CVE-2015-5212, boo#934423     CVE-2015-4551

  - Use gcc48 to build on sle11sp4

  - Make debuginfo's smaller on IBS.

  - Fix chrpath call after the libs got -lo suffixing

  - Add patch to fix qt4 features detection :

  - kde4filepicker.patch

  - Split out gtk3 UI to separate subpkg that requires gnome     subpkg

  - This is to allow people to test gtk3 while it not being     default

  - Version update to 5.0.2 rc1 :

  - Various small tweaks and integration of our SLE11     patchsets

  - Update constraints to 30 GB on disk

  - Version bump to 5.0.1 rc2 :

  - breeze icons extension

  - Credits update

  - Various small fixes

  - Version bump to 5.0.1 rc1 :

  - Various small fixes

  - Has some commits around screen rendering -> could fix     kde bugs

  - Kill branding-openSUSE, stick to TDF branding.

  - Version bump to 5.0 rc5 :

  - Bunch of final touchups here and there

  - Remove some upstreamed patches :

  - old-cairo.patch

  - Add explicit requires over libmysqlclient_r18, should     cover boo#829430

  - Add patch to build with old cairo (sle11).

  - Version bump to 5.0 rc3 :

  - Various more fixes closing on the 5.0 release

  - Update to 5.0 rc2 :

  - Few small fixes and updates in internal libraries

  - Version bump to 5.0 rc1, remove obsolete patches :

  -     0001-Fix-could-not-convert-.-const-char-to-const-rtl-OUS     t.patch

  - 0001-writerperfect-fix-gcc-4.7-build.patch

  - More chrpat love for sle11

  - Add python-importlib to build/requirements on py2     distros

  - Provide/obsolete crystal icons so they are purged and     not left over

  - Fix breeze icons handling, drop crystal icons.

  - Version bump to 5.0.0.beta3 :

  - Drop merged patch     0001-Make-cpp-poppler-version.h-header-optional.patch

  - Update some internal tarballs so we keep building

  - based on these bumps update the buildrequires too

  - Generate python cache files wrt boo#929793

  - Update %post scriptlets to work on sle11 again

  - Split out the share -> lib linker to hopefully allow     sle11 build

  - One more fix for help handling boo#915996

  - Version bump to 4.4.3 release :

  - Various small fixes all around

  - Disable verbose build to pass check on maximal size of     log

  - We need pre/post for libreoffice in langpkgs

  - Use old java for detection and old commons-lang/codec to     pass brp check on java from sle11

  - 0001-Make-HAVE_JAVA6-be-always-false.patch

  - Revert last changeset, it is caused by something else     this time :

  - 0001-Set-source-and-target-params-for-java.patch

  - Set source/target for javac when building to work on     SLE11 :

  - 0001-Set-source-and-target-params-for-java.patch

  - Try to deal with rpath on bundled libs

  - Fix python3_sitelib not being around for py2

  - Add internal make for too old system

  - One more stab on poppler switch :

  - 0001-Make-cpp-poppler-version.h-header-optional.patch

  - Update the old-poppler patch to work correctly :

  - 0001-Make-cpp-poppler-version.h-header-optional.patch

  - Sort out more external tarballs for the no-system-libs     approach

  - Add basic external tarballs needed for     without-system-libraries

  - Add patch to check for poppler more nicely to work on     older distros :

  - 0001-Make-cpp-poppler-version.h-header-optional.patch

  - Try to pass configure without system libs

  - Allow switch between py2 and py3

  - Move external dependencies in conditional thus allow     build on SLE11

  - Add conditional for noarch subpackages

  - Add switch in configure to detect more of     internal/external stuff

  - Add conditional for appdatastore thing and redo it to     impact the spec less

  - Add systemlibs switch to be used in attempt to build     sle11 build

  - Silence more scarry messages by boo#900186

  - Fixes autocorr symlinking

  - Cleans UNO cache in more pretty way

  - Clean up the uno cache removal to not display scarry     message boo#900186

  - Remove patch to look for help in /usr/share, we symlink     it back to lib, so there is no actual need to search for     it directly, migth fix boo#915996 :

  - officecfg-help-in-usr-share.diff

  - --disable-collada

  - reportedly it does not work in LibreOffice 4.4

  - added version numbers to some BuildRequires lines

  - Require flow engine too on base

  - Fix build on SLE12 and 13.1 by adding conditional for     appdata install

  - Fixup the installed appdata.xml files: they reference a     .desktop file that are not installed by libreoffice     (boo#926375).

  - Version bump to 4.4.2 :

  - 2nd bugfix update for the 4.4 series

  - BuildRequires: libodfgen-devel >= 0.1

  - added version numbers to some BuildRequires lines

  - build does not require python3-lxml

  - build requires librevenge-devel >= 0.0.1

  - vlc media backend is broken, don't use it. Only     gstreamer should be used.

  - Install the .appdata.xml files shipped by upstream:
    allow LO to be shown in AppStream based software     centers.

  - Move pretrans to pre

  - Version bump to 4.4.1 first bugfix release of the series

  - Reduce bit the compilation preparations as we prepped     most of the things by _constraints and it is no longer     needed

  - %pre is not enough the script needs to be rewritten in     lua

  - Move removal of obsolete dirs from %pretrans to %pre     boo#916181

  - Version bump to 4.4.0 final :

  - First in the 4.4 series

  - First release to have the new UI elements without old     hardcoded sizes

  - Various improvements all around.

  - Version bump to 4.4.0rc2 :

  - Various bugfixes, just bumping to see if we still build     fine.

  - That verbose switch for configure was really really bad     idea

  - generic images.zip for galaxy icons seem gone so remove

  - Do not supplement kde3 stuff, it is way beyond obsolete

  - Remove vlc conditional

  - korea.xcd is no more so remove

  - Really use mergelib

  - Disable telepathy, it really is experimental like hell

  - Version bump to 4.4.0rc1 :

  - New 4.4 branch release with additional features

  - Enable collada :

  - New bundled collada2gltf tarball:
    4b87018f7fff1d054939d19920b751a0-collada2gltf-master-cb1     d97788a.tar.bz2

  - Remove errorous self-obsolete in lang pkgs.

  - Version bump to 4.3.3.2 :

  - Various bugfixes from maintenance branch to copy     openSUSE.

  - Also contains fix for boo#900214 and boo#900218     CVE-2014-3693

  - fix regression in bullets (boo#897903).

  - Add masterpage_style_parent.odp as new file for     regression test for bullets. Changes in cmis-client :

  - Update to version 0.5.0

  + Completely removed the dependency on InMemory server for     unit tests

  + Minimized the number of HTTP requests sent by     SessionFactory::createSession

  + Added Session::getBaseTypes()

  - Bump soname to 0_5-5

  - Bump incname to 0.5

Changes in libetonyek :

  - Version bump to 0.1.3 :

  - Various small fixes

  - More imported now imported

  - Now use mdds to help with some hashing

  - Version bump to 0.1.2 :

  - Initial support for pages and numbers

  - Ditch libetonyek-0.1.1-constants.patch as we do not     require us to build for older boost

Changes in libmwaw :

  - Version bump to 0.3.6 :

  - Added a minimal parser for ApplePict v1.v2, ie. no     clipping, does not take in account the copy mode:
    srcCopy, srcOr, ...

  - Extended the --with-docs configure option to allow to     build doc only for the API classes:
    --with-docs=no|api|full .

  - Added a parser for MacDraft v4-v5 documents.

  - RagTime v5-v6 parser: try to retrieve the main layouts     and the picture/shape/textbox, ie. now, it generates     result but it is still very imcomplete... 

  - MWAW(Graphic,Presentation,Text)Listener: corrected a     problem in openGroup which may create to incorrect     document.

  - Created an MWAWEmbeddedObject class to store a picture     with various representations.

  - MWAW*Listener: renamed insertPicture to insertShape,     added a function to insert a texbox in a     MWAWGraphicShape (which only insert a basic textbox).

  - Fixed many crashes and hangs when importing broken     files, found with the help of american-fuzzy-lop.

  - And several other minor fixes and improvements.

  - Version bump to 0.3.5

  - Various small fixes on 0.3 series, nothing big woth     mention

Changes in libodfgen :

  - Version bump to 0.1.4 :

  - drawing interface: do no forget to call     startDocument/endDocument when writing in the manifest

  - metadata: added handler for 'template' metadata, unknown     metadata are written in a meta:user-defined elements,

  - defineSheetNumberingStyle: can now define styles for the     whole document (and not only for the actual sheet)

  - update doxygen configuration file + add a make astyle     command

  - Allow writing meta:creation-date metadata element for     drawings and presentations too.

  - Improve handling of headings. Most importantly, write     valid ODF.

  - Write meta:generator metadata element.

  - Add initial support for embedded fonts. It is currently     limited to Flat ODF output.

  - Upgrade to version 0.1.2

  - Use text:h element for headings. Any paragraph with     text:outline-level property is recognized as a heading.

  - Handle layers.

  - Improve handling of styles. Particularly, do not emit     duplicate styles.

  - Slightly improve documentation.

  - Handle master pages.

  - Do not expect that integer properties are always in     inches.

  - Fix misspelled style:paragraph-properties element in     presentation notes.

  - Only export public symbols on Linux.

  - Fix bogus XML-escaping of metadata values.

  - And many other improvements and fixes.

Changes in libpagemaker :

  - Initial package based on upstream libpagemaker 0.0.2

Changes in libreoffice-share-linker :

  - Initial commit, split out from main libreoffice package     to workaround issues on SLE11 build Changes in mdds :

  - Update to version 0.12.1 :

  - Various small fixes on 0.12 series

  - Just move define up and comment why we redefine docdir

  - more types are possible in segment_tree data structures     (previously only pointers were possible)

  - added sorted_string_map

  - multi_type_vector bugfixes Changes in libwps :

  - Update to version 0.4.1 :

  + QuattroPro: correct a mistake when reading negative     cell's position.

  + Fix some Windows build problems.

  + Fix more than 10 hangs when reading damaged files, found     with the help of american-fuzzy-lop.

  + Performance: improve the sheet's output generation.

  + add support for unknown encoding files (ie. DOS file)

  + add potential support for converting Lotus, ...
    documents,

  + accept to convert all Lotus Wk1 files and Symphony Wk1     files,

  + add support for Lotus Wk3 and Wk4 documents,

  + add support for Quattro Pro Wq1 and Wq2 documents,

  + only in debug mode, add pre-support for Lotus Wk5...,     must allow to retrieve the main sheets content's with no     formatting,

  + add potential support for asking the document's password     ( but do nothing )

  + correct some compiler warnings when compiling in debug     mode.

  + Fix parsing of floating-point numbers in specific cases.

  + Fix several minor issues reported by Coverity and Clang.

  + Check arguments of public functions. Passing NULL no     longer causes a crash.

  + Use symbol visibility on Linux. The library only exports     the public functions now.

  + Import @TERM and @CTERM functions (fdo#86241).

  + Handle LICS character encoding in spreadsheets     (fdo#87222).

  + Fix a crash when reading a broken file, found with the     help of american-fuzzy-lop.

远程主机上运行的 Apple iTunes 版本低于 12.3。因此，它受到 WebKit、CoreText 和 ICU 组件中以及 Microsoft Visual Studio C++ Redistributable Package 的捆绑版本中多种漏洞的影响。攻击者可利用这些漏洞造成拒绝服务、执行任意代码或者获取已加密 SMB 凭据的访问权限。

请注意，Nessus 并未测试这些问题，而是只依赖于应用程序自我报告的版本号。

远程 Windows 主机上安装的 Apple iTunes 版本低于 12.3。因此，它受到 WebKit、CoreText、Microsoft Visual Studio C++ Redistributable Package 和 ICU 的捆绑版本中的多种漏洞的影响。

请注意，Nessus 并未测试这些问题，而是只依赖于应用程序自我报告的版本号。

此更新将 LibreOffice 升级到版本 5.0.4，这是一个主要版本更新。

它包含大量新功能、缺陷补丁以及安全补丁。

功能请参阅 http://www.libreoffice.org/discover/new-features/

- LibreOffice 5.0 随附的 Calc 电子表格模块具有大量新功能：复杂公式图像裁剪、新函数、更强大的条件格式化、表寻址等。
 Calc 的混合性能和特征使其成为一款能够处理广泛用例的各种工作负载的企业即用型高负荷电子表格应用程序

- 新图标、菜单和侧边栏的重大改进：此版本的 LibreOffice 在外观方面做到尽善尽美，可最大程度帮助激发创意和高效完成工作。此外，由于界面内的风格虚拟化，现在风格管理也更为直观。

- LibreOffice 5 随附 MS Office、PDF、RTF 等的大量文档导入和导出过滤器改进。现在您可以在 LibreOffice 生成的 PDF 文档中使用时间戳，并全面获得增强文档转换保真度。

现在增加并启用了 Pentaho Flow Reporting Engine。

修复的安全问题：

- CVE-2014-8146：在低于 55.1 的 International Components for Unicode (ICU) 中，ICU4C 的 Unicode 双向算法实现中 common/ubidi.c 中的 resolveImplicitLevels 函数未正确跟踪定向隔离的文本部分，这允许远程攻击者通过构建的文本造成拒绝服务（基于堆的缓冲区溢出）或可能执行任意代码。

- CVE-2014-8147：在低于 55.1 的 International Components for Unicode (ICU) 中，ICU4C 的 Unicode 双向算法实现中 common/ubidi.c 中的 resolveImplicitLevels 函数使用与标头文件不相符的整数数据类型，这允许远程攻击者通过构建的文本造成拒绝服务（内存分配错误及之后的无效释放）或可能执行任意代码。

- CVE-2015-4551：修复了 Libreoffice、Openoffice Calc 和 Writer 中的任意文件泄露漏洞。

- CVE-2015-5212：LibreOffice 的“PrinterSetup Length”整数下溢漏洞，提供文档的攻击者可利用此漏洞，在用户打开文档时执行代码。

- CVE-2015-5213：LibreOffice 的“Piece Table Counter”无效检查设计错误漏洞，提供文档的攻击者可利用此漏洞，在用户打开文档时执行代码。

- CVE-2015-5214：多个供应商的 LibreOffice 书签状态内存损坏漏洞，允许提供文档的攻击者在用户打开文档时执行代码。

请注意，Tenable Network Security 已直接从 SUSE 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下尽可能进行了自动整理和排版。

此 LibreOffice 及某些库依存关系（cmis-client、libetonyek、libmwaw、libodfgen、libpagemaker、libreoffice-share-linker、mdds、libwps）的更新修复了以下问题：

libreoffice 中的变更：

- 从 pt-PT 提供 l10n-pt

- boo#945047 - LO-L3：LO 是重复的主页面，扩展补丁

- boo#951579 - LO-L3：[LibreOffice] Calc 5.0 无法打开 ods 文件

- 删除 RPATH 可防止加载随附的第三方 RDF 处理程序 libs

- 5.0.4.2 的版本更新：

- 5.0.4 系列的最终版本

- boo#945047 - LO-L3：LO 是重复的主页面

- 5.0.4.1 的版本更新：

- 5.0.4 的 rc1，含各种回归补丁

- boo#954345 - LO-L3：插入 --> 图像 --> 作为链接插入挂起写入器

- 5.0.3.2 的版本更新：

- 5.0.3 版的最终标签

- 修复 boo#939996 - LO-L3：未导入来自 DOCX 文件的某些位

- 修复 boo#889755 - LO-L3：PPTX：图表轴号码格式不正确

- boo#679938 - LO-L3：保存至 doc 文件 标头中的章节名称不会随章节变更

- 更新到版本 5.0.3RC1，因为它应该修复 i586 测试失败

- 更新 text2number 扩展至 1.5.0

- 过时的 libreoffice-mono

- pentaho-flow-reporting 要求在 system_libs 上是有条件的

- 更新图标主题依存关系

- https://lists.debian.org/debian-openoffice/2015/09/msg00343.html

- 版本升级到 5.0.2 最终 fate#318856 fate#319071 boo#943075 boo#945692：

- 相较于 rc1 的小调整

- 出于完整性原因，此版本也包含 boo#910806 CVE-2014-8147、boo#907636 CVE-2014-9093、boo#934423 CVE-2015-4551、boo#910805 CVE-2014-8146、boo#940838 CVE-2015-5214、boo#936190 CVE-2015-5213、boo#936188 CVE-2015-5212、boo#934423 CVE-2015-45513、boo#934423 CVE-2015-4551、boo#910805 CVE-2014-8146、boo#940838 CVE-2015-5214、boo#936190 CVE-2015-5213、boo#936188 CVE-2015-5212、boo#934423 CVE-2015-45513、boo#934423 CVE-2015-4551、boo#910805 CVE-2014-8146、boo#940838 CVE-2015-5214、boo#936190 CVE-2015-5213、boo#936188 CVE-2015-5212、boo#934423 CVE-2015-4551 的安全补丁

- 使用 gcc48 在 sle11sp4 上构建

- 使 IBS 上的 debuginfo's 小一点。

- 修复 libs got -lo 后缀之后的 chrpath 调用

- 添加修补程序以修复 qt4 功能检测：

- kde4filepicker.patch

- 将 gtk3 UI 拆分到需要 gnome subpkg 的单独 subpkg

- 这可允许用户在 gtk3 不是默认的情况下加以测试

- 版本更新到 5.0.2 rc1：

- 各种小调整并整合我们的 SLE11 修补程序集

- 更新磁盘限制到 30 GB

- 版本升级到 5.0.1 rc2：

- breeze 图标扩展

- 感谢更新

- 各种小补丁

- 版本升级到 5.0.1 rc1：

- 各种小补丁

- 有一些关于屏幕渲染的提交 -> 可修复 kde 缺陷

- 终止 branding-openSUSE，坚持 TDF 品牌。

- 版本升级到 5.0 rc5：

- 各处的多个最终改进

- 删除某些上游修补程序：

- old-cairo.patch

- 添加 libmysqlclient_r18 的明确要求，应该涵盖 boo#829430

- 为具有旧 cairo 的版本添加修补程序 (sle11)。

- 版本升级到 5.0 rc3：

- 更多关于 5.0 版的各种补丁

- 更新到 5.0 rc2：

- 内部库的一些小补丁和更新

- 版本升级到 5.0 rc1，删除过时的修补程序：

- 0001-Fix-could-not-convert-.-const-char-to-const-rtl-OUS t.patch

- 0001-writerperfect-fix-gcc-4.7-build.patch

- 更多对 sle11 的 chrpat 喜爱

- 添加 python-importlib 至 py2 distros 上的版本/要求

- 提供/弃用 crystal 图标，以便将它们清除且不会残留

- 修复 breeze 图标处理，终止 crystal 图标。

- 版本升级到 5.0.0.beta3：

- 终止已合并的修补程序 0001-Make-cpp-poppler-version.h-header-optional.patch

- 更新某些内部 tarball，以便我们继续构建

- 根据这些升级，也更新 buildrequires

- 生成 python 缓存文件 wrt boo#929793

- 更新 %post 小脚本以便在 sle11 上再次运行

- 拆分 share -> lib 链接器以便允许 sle11 版本

- 针对帮助处理 boo#915996 的另一个补丁

- 版本升级到 4.4.3 版本：

- 各种小补丁

- 禁用 verbose 版本以通过日志大小上限检查

- 针对 langpkgs 中的 libreoffice，我们需要 pre/post

- 使用旧的 java 进行检测，并使用旧的 commons-lang/编解码器以从 sle11 通过对 java 的 brp 检查

- 0001-Make-HAVE_JAVA6-be-always-false.patch

- 恢复上一个变更集，这次是由其他原因造成：

- 0001-Set-source-and-target-params-for-java.patch

- 构建时设置 javac 的来源/目标，以便在 SLE11 上运行：

- 0001-Set-source-and-target-params-for-java.patch

- 尝试在随附的 libs 上处理 rpath

- 修复 python3_sitelib 不可用于 py2 的问题

- 添加针对过旧系统的内部制作

- 针对 poppler 交换器的再一次尝试：

- 0001-Make-cpp-poppler-version.h-header-optional.patch

- 更新 old-poppler 修补程序以便正确运行：

- 0001-Make-cpp-poppler-version.h-header-optional.patch

- 挑选出更多适用于 no-system-libs 方法的外部 tarball

- 添加 without-system-libraries 所需的基本外部 tarball

- 添加可更精确检查 poppler 的修补程序，以便在较旧的 distros 上运行：

- 0001-Make-cpp-poppler-version.h-header-optional.patch

- 尝试在没有系统 libs 的情况下传递配置

- 允许在 py2 和 py3 之间切换

- 移动条件中的外部依存关系，以便允许在 SLE11 上构建

- 添加 noarch 子程序包的条件

- 在配置中添加交换器，以便检测更多内部/外部内容

- 添加 appdatastore 内容的条件并加以重做，以便减少其对规格的影响

- 添加 systemlibs 交换器，以便在尝试构建 sle11 版本时使用

- 静默更多由 boo#900186 发出的可怕消息

- 修复 autocorr 符号链接

- 以更好的方式清除 UNO 缓存

- 清理 uno 缓存删除操作，以便不显示可怕消息 boo#900186

- 删除用于在 /usr/share 中查找帮助的修补程序，我们将它符号链接回 lib，因此实际上不需要直接搜索它，可修复 boo#915996：

- officecfg-help-in-usr-share.diff

- --disable-collada

- 据报告，它无法在 LibreOffice 4.4 中工作

- 在某些 BuildRequires 行中添加了版本号

- 基底上也需要流量引擎

- 通过添加 appdata 安装的条件，修复 SLE12 和 13.1 上的版本

- 修复已安装的 appdata.xml 文件：它们引用非由 libreoffice 安装的 .desktop 文件 (boo#926375)。

- 版本升级到 4.4.2：

- 4.4 系列的第 2 次缺陷补丁更新

- BuildRequires：libodfgen-devel >= 0.1

- 在某些 BuildRequires 行中添加了版本号

- 版本不需要 python3-lxml

- 版本需要 librevenge-devel >= 0.0.1

- vlc 媒体后端已损坏，请勿使用。只应使用 gstreamer。

- 安装上游随附的 .appdata.xml 文件：
允许 LO 显示在基于 AppStream 的软件中心。

- 将 pretrans 移至 pre

- 版本升级到 4.4.1，系列的第一个缺陷补丁版本

- 减少编译准备工作，因为我们通过 _constraints 已做好大部分准备，因此不再需要

- %pre 不足够，脚本必须以 lua 重写

- 将过时目录的删除操作从 %pretrans 移至 %pre boo#916181

- 版本升级到 4.4.0 最终版本：

- 4.4 系列中的第一个

- 具备新 UI 元素且没有旧硬编码大小的第一个版本

- 各种各样的改进。

- 版本升级到 4.4.0rc2：

- 各种缺陷补丁，请升级并查看我们构建的版本是否良好。

- 那个用于配置的 verbose 交换器真是个坏注意

- 银河图标的通用 images.zip 似乎不见了，因此删除

- 不要增补 kde3 内容，它早已过时

- 删除 vlc 条件

- korea.xcd 不再存在，因此删除

- 确实使用 mergelib

- 禁用 telepathy，它真的是非常差劲的实验

- 版本升级到 4.4.0rc1：

- 包含额外功能的新 4.4 分支版本

- 启用 collada：

- 新的随附 collada2gltf tarball：
 4b87018f7fff1d054939d19920b751a0-collada2gltf-master-cb1 d97788a.tar.bz2

- 删除语言程序包中的错误自我弃用。

- 版本升级到 4.3.3.2：

- 来自维护分支的各种缺陷补丁，用以复制 openSUSE。

- 也包含针对 boo#900214 和 boo#900218 CVE-2014-3693 的补丁

- 修复项目符号中的回归 (boo#897903)。

- 将 masterpage_style_parent.odp 添加为项目符号回归测试的新文件。cmis-client 中的变更：

- 更新到版本 0.5.0

+ 完全删除 InMemory 服务器上针对单元测试的依存关系

+ 最小化由 SessionFactory::createSession 发送的 HTTP 请求数

+ 添加 Session::getBaseTypes()

- 将 soname 升级到 0_5-5

- 将 incname 升级到 0.5

libetonyek 中的变更：

- 版本升级到 0.1.3：

- 各种小补丁

- 现已导入更多导入

- 现在使用 mdds 以帮助某些哈希

- 版本升级到 0.1.2：

- 针对页面和数字的初始支持

- 舍弃 libetonyek-0.1.1-constants.patch，因为我们已不需要针对较旧的 boost 构建

libmwaw 中的变更：

- 版本升级到 0.3.6：

- 添加适用于 ApplePict v1.v2 的最小解析器，即无裁剪，不考虑复制模式：
 srcCopy、srcOr、...

- 扩展 --with-docs 配置选项，以允许仅针对 API 类别构建文件：
 --with-docs=no|api|full 。

- 添加 MacDraft v4-v5 文档的解析器。

- RagTime v5-v6 解析器：尝试检索主要布局和 picture/shape/textbox，即，现在它会生成结果，但仍旧不完整... 

 - MWAW{Graphic,Presentation,Text}Listener：修复 openGroup 中可能创建不正确文档的一个问题。

- 创建一个 MWAWEmbeddedObject 类别，以便存储有多种表示的图片。

- MWAW*Listener：将 insertPicture 重命名为 insertShape，添加在 MWAWGraphicShape 中插入文本框的新功能（仅插入基本的文本框）。

- 修复导入受损文件时，在 american-fuzzy-lop 的帮助下发现的多个崩溃和挂起。

- 添加其他多个次要补丁与改进。

- 版本升级到 0.3.5

- 有关 0.3 系列的各种小补丁，没有什么值得一提

libodfgen 中的变更：

- 版本升级到 0.1.4：

- 绘图接口：在指令清单中写入时，记得要调用 startDocument/endDocument

- 元数据：添加“模板”元数据的处理程序，未知元数据会写入 meta:user-defined 元素中，

- defineSheetNumberingStyle：现在可针对整个文档定义样式（而不仅针对实际的工作表）

- 更新 doxygen 配置文件 + 添加一个制作 astyle 命令

- 允许也针对绘图和演示写入 meta:creation-date 元数据元素。

- 改善标头的处理最重要的是，写入有效的 ODF。

- 写入 meta:generator 元数据元素。

- 添加针对内嵌字体的初始支持。目前限于 Flat ODF 输出。

- 升级到版本 0.1.2

- 使用针对标头的 text:h 元素。任何具有 text:outline-level 属性的段落都会被视为标头。

- 处理分层。

- 改善对样式的处理特别是，不发出重复的样式。

- 略微改善文档。

- 处理主页面。

- 不会预期整数属性始终以英吋为单位。

- 修复演示注释中拼字错误的 style:paragraph-properties 元素。

- 仅导出 Linux 上的公开符号。

- 修复元数据值的虚假 XML 转义。

- 以及其他许多改进和补丁。

libpagemaker 中的变更：

- 基于上游 libpagemaker 0.0.2 的初始程序包

libreoffice-share-linker 中的变更：

- 初始提交，从主要 libreoffice 程序包拆分，以便解决 SLE11 版本的变通方案问题 mdds 中的变更：

- 更新到 0.12.1 版：

- 有关 0.12 系列的各种小补丁

- 尽管上移定义，并注释我们重新定义 docdir 的原因

- 在 segment_tree data 结构中可使用更多类型（之前只能使用指针）

- 添加 sorted_string_map

- multi_type_vector 缺陷补丁 libwps 中的变更：

- 更新到 0.4.1 版：

+ QuattroPro：修复在读取负单元格位置时的一个错误。

+ 修复某些 Windows 版本问题。

+ 修复读取受损文件时，在 american-fuzzy-lop 的帮助下发现的 10 多个挂起。

+ 性能：改善工作表的输出生成。

+ 添加针对未知编码文件（即 DOS 文件）的支持

+ 添加可能的支持，用来转换 Lotus, ...
 文档，

+ 接受转换所有 Lotus Wk1 文件和 Symphony Wk1 文件，

+ 添加针对 Lotus Wk3 和 Wk4 文档的支持，

+ 添加针对 Quattro Pro Wq1 和 Wq2 文档的支持，

+ 仅在调试模式中，添加针对 Lotus Wk5... 的预支持，必须允许检索没有格式化的主要工作表内容，

+ 添加可能的支持，用来询问文档的密码（但不执行任何操作）

+ 修复在调试模式中编译时的某些编译器警告。

+ 修复特定情况中的浮点数解析。

+ 修复多个由 Coverity 和 Clang 报告的次要问题。

+ 检查公开函数的参数。解析 NULL 不会再造成崩溃。

+ 在 Linux 上使用符号可见性。库现在仅导出公开函数。

+ 导入 @TERM 和 @CTERM 函数 (fdo#86241)。

+ 处理电子表格中的 LICS 字符编码 (fdo#87222)。

+ 修复读取受损文件时，在 american-fuzzy-lop 的帮助下发现的一个崩溃。

The remote host is running a version of Mac OS X that is 10.6.8 or later but prior to 10.11 and is affected by multiple vulnerabilities in the following components : 

 - Address Book 
 - AirScan 
 - apache_mod_php 
 - Apple Online Store Kit 
 - AppleEvents 
 - Audio 
 - bash 
 - Certificate Trust Policy 
 - CFNetwork Cookies - CFNetwork FTPProtocol 
 - CFNetwork HTTPProtocol 
 - CFNetwork Proxies 
 - CFNetwork SSL 
 - CoreCrypto 
 - CoreText 
 - Dev Tools 
 - Disk Images 
 - dyld 
 - EFI 
 - Finder 
 - Game Center 
 - Heimdal 
 - ICU 
 - Install Framework Legacy 
 - Intel Graphics Driver 
 - IOAudioFamily 
 - IOGraphics 
 - IOHIDFamily 
 - IOStorageFamily 
 - Kernel 
 - libc 
 - libpthread 
 - libxpc 
 - Login Window 
 - lukemftpd 
 - Mail 
 - Multipeer Connectivity 
 - NetworkExtension 
 - Notes 
 - OpenSSH 
 - OpenSSL 
 - procmail 
 - remote_cmds 
 - removefile 
 - Ruby 
 - Safari 
 - Safari Downloads 
 - Safari Extensions 
 - Safari Safe Browsing 
 - Security 
 - SMB 
 - SQLite 
 - Telephony 
 - Terminal 
 - tidy 
 - Time Machine 
 - WebKit 
 - WebKit CSS 
 - WebKit JavaScript Bindings 
 - WebKit Page Loading 
 - WebKit Plug-ins

The remote host is running a version of iOS that is prior to version 9.0 and the following components contain vulnerabilities :

 - Apple Pay 
 - AppleKeyStore 
 - Application Store 
 - Audio 
 - Certificate Trust Policy 
 - CFNetwork 
 - CFNetwork Cookies 
 - CFNetwork FTPProtocol 
 - CFNetwork Proxies 
 - CFNetwork SSL 
 - CoreAnimation 
 - CoreCrypto 
 - CoreText 
 - Data Detectors Engine 
 - Dev Tools 
 - Disk Images 
 - dyld 
 - Game Center 
 - ICU 
 - IOAcceleratorFamily 
 - IOHIDFamily 
 - IOKit 
 - IOMobileFrameBuffer 
 - IOStorageFamily 
 - iTunes Store 
 - JavaScriptCore 
 - Kernel 
 - libc 
 - libpthread 
 - Mail 
 - Multipeer Connectivity 
 - NetworkExtension 
 - OpenSSL 
 - PluginKit 
 - removefile 
 - Safari 
 - Safari Safe Browsing 
 - Security 
 - Siri 
 - SpringBoard 
 - SQLite 
 - tidy 
 - WebKit 
 - WebKit Canvas 
 - WebKit Page Loading

Versions of iTunes earlier than 12.3 are affected by multiple vulnerabilities which include :

 - A flaw exists in Microsoft Foundation Class's handling of library loading due to the use of a fixed path.  An attacker can place a custom version of the file or library in the path, and the program will load it before the legitimate version.  Thus, an attacker can leverage this flaw to execute custom code. (CVE-2010-3190)
 - International Components for Unicode for C/C++ (ICU4C) contains several flaws.  An overflow condition exists in the resolveImplicitLevels() function in 'ubidi.c', which is triggered as user-supplied input is not properly validated. Additionally, an integer truncation flaw exists in the same function in 'ubidi.c'.   Either flaw may allow an attacker to crash an application linked against the library or potentially execute arbitrary code. (CVE-2014-8146, CVE-2014-8147, CVE-2015-5922)
 - A flaw exists in CoreText that is triggered as user-supplied input is not properly validated when handling text and font files. This may allow a context-dependent attacker can corrupt memory and potentially execute arbitrary code. (CVE-2015-1157, CVE-2015-5874, CVE-2015-3686, CVE-2015-3687, CVE-2015-3688, CVE-2015-5755, CVE-2015-5761)
 - A flaw exists that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2015-1152, CVE-2015-1153, CVE-2015-3730, CVE-2015-3731, CVE-2015-3733, CVE-2015-3734, CVE-2015-3735, CVE-2015-3736, CVE-2015-3737, CVE-2015-3738, CVE-2015-3739, CVE-2015-3740, CVE-2015-3741, CVE-2015-3742, CVE-2015-3743, CVE-2015-3744, CVE-2015-3745, CVE-2015-3746, CVE-2015-3747, CVE-2015-3748, CVE-2015-3749, CVE-2015-5789, CVE-2015-5790, CVE-2015-5791, CVE-2015-5792, CVE-2015-5793, CVE-2015-5794, CVE-2015-5795, CVE-2015-5796, CVE-2015-5797, CVE-2015-5798, CVE-2015-5799, CVE-2015-5800, CVE-2015-5801, CVE-2015-5802, CVE-2015-5803, CVE-2015-5804, CVE-2015-5805, CVE-2015-5806, CVE-2015-5807, CVE-2015-5808, CVE-2015-5809, CVE-2015-5810, CVE-2015-5811, CVE-2015-5812, CVE-2015-5813, CVE-2015-5814, CVE-2015-5815, CVE-2015-5816, CVE-2015-5817, CVE-2015-5818, CVE-2015-5819, CVE-2015-5821, CVE-2015-5822, CVE-2015-5823)
 - An unspecified flaw exists that is triggered during the handling of network connection redirects. This may allow a remote man-in-the-middle attacker to gain access to hashed SMB credential information. (CVE-2015-5920)

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
86601	Apple iTunes < 12.3 Multiple Vulnerabilities (uncredentialed check)	Nessus	Peer-To-Peer File Sharing	2015/10/26	2019/11/20	high
86001	Apple iTunes < 12.3 Multiple Vulnerabilities (credentialed check)	Nessus	Windows	2015/9/18	2019/11/22	high
88575	SUSE SLED11 Security Update : Recommended update for LibreOffice (SUSE-SU-2016:0324-1)	Nessus	SuSE Local Security Checks	2016/2/4	2021/1/6	high
89016	openSUSE Security Update : LibreOffice and related libraries (openSUSE-2016-273)	Nessus	SuSE Local Security Checks	2016/2/29	2021/1/19	high
86601	Apple iTunes < 12.3 多种漏洞（无凭据检查）	Nessus	Peer-To-Peer File Sharing	2015/10/26	2019/11/20	high
86001	Apple iTunes < 12.3 多种漏洞（凭据检查）	Nessus	Windows	2015/9/18	2019/11/22	high
88575	SUSE SLED11 安全更新：LibreOffice 的建议更新 (SUSE-SU-2016:0324-1)	Nessus	SuSE Local Security Checks	2016/2/4	2021/1/6	high
89016	openSUSE 安全更新：LibreOffice 和相关库 (openSUSE-2016-273)	Nessus	SuSE Local Security Checks	2016/2/29	2021/1/19	high
8982	Mac OS X < 10.11 Multiple Vulnerabilities	Nessus Network Monitor	Operating System Detection	2015/10/28	2019/3/6	critical
8979	Apple iOS < 9.0 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices	2015/10/15	2019/3/6	critical
8958	iTunes for Windows < 12.3 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2015/10/23	2019/3/6	high

检测

插件搜索

high

high

high

high

high

high

high

high

critical

critical

high