The Document Foundation has released a major security update for the free LibreOffice desktop software, which helps protect against macro viruses. If you are using a version of LibreOffice earlier than version 6.2.5, you must update to the latest version now.
Macro viruses generally spread in Office documents and begin a series of actions when the document is opened. As reported by The Register, uncorrected versions of LibreOffice, three vulnerabilities meant that some macros could run silently when you opened a document without giving you the option to stop everything. suspicious item
The vulnerabilities involved a feature called LibreLogo, designed to teach programming. By typing commands with the simple Logo programming language, you can control a "turtle" graphic and move it into your document. This is a fun introduction to coding, but it has resulted in a number of problems.
The first problem was that the Logo commands had been converted to Python without proper security controls to ensure no malicious action was taken. The second is that all built-in LibreOffice macros have been marked as "fully trusted" regardless of the chosen security settings, including LibreLogo, optional but installed by default. The third and final problem was that LibreLogo was sending arbitrary Python code in the document to be interpreted, not just explicitly written commands.
Keep your PC safe
Together, these three vulnerabilities meant that if you received a document that contained malicious Python code, it would run automatically when the document was opened without prompting for confirmation.
Files that contain a macro virus are often sent as email attachments. Be skeptical of unexpected attachments, even if they seem innocuous and are of a file type that you recognize.
LibreOffice should be configured to check for automatic updates by default, but you can check its settings by clicking Tools> Options> LibreOffice> Online Update. Here you can also choose whether the software should check for updates daily, weekly, monthly, or whenever you are connected to the internet.
When an update is available, an icon appears in the menu bar. The update download will start immediately if automatic updates are enabled; otherwise you will need to click on it to begin the process.