Bug 130686 - ClamAV reports an Infected LibreOffice macro
Summary: ClamAV reports an Infected LibreOffice macro
Status: RESOLVED NOTABUG
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: BASIC (show other bugs)
Version:
(earliest affected)
6.0.7.3 release
Hardware: All Linux (All)
: medium normal
Assignee: Not Assigned
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2020-02-15 13:03 UTC by Bazza
Modified: 2020-05-09 14:04 UTC (History)
1 user (show)

See Also:
Crash report or crash signature:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Bazza 2020-02-15 13:03:48 UTC 
Description:
Report line from ClamAV:
.config/libreoffice/4/user/basic/Standard/Module1.xba: PUA.Doc.Tool.LibreOfficeMacro-2 FOUND

This after a standard installation of LibreOffice v6.0.7.3 (Build 1:6.0.7-0ubuntu0.18.04.10) from the Software Manager on Linux Mint 19.3 Cinnamon 4.4.8.

Steps to Reproduce:
1. Standard install on Linix Mint.
2. Scheduled daily run of ClamAV
3. View history of Clam reports.

Actual Results:

-------------------------------------------------------------------------------

/home/barry/.config/libreoffice/4/user/basic/Standard/Module1.xba: PUA.Doc.Tool.LibreOfficeMacro-2 FOUND

----------- SCAN SUMMARY -----------
Known viruses: 6751179
Engine version: 0.102.1
Scanned directories: 894
Scanned files: 2889
Infected files: 1
Data scanned: 533.78 MB
Data read: 820.86 MB (ratio 0.65:1)
Time: 73.265 sec (1 m 13 s)


Expected Results:
Ø Infected files after standard LibreOffice install


Reproducible: Always


User Profile Reset: No


OpenGL enabled: Yes

Additional Info:
[Information automatically included from LibreOffice]
Locale: en-GB
Module: TextDocument
[Information guessed from browser]
OS: Linux (All)
OS is 64bit: yes
Comment 1 Mike Kaganski 2020-02-15 13:44:05 UTC 
ClamAV finds a macro; it has an entry for "Potentially Unwanted Application: document tool - LibreOffice Macro". What could be done for that? remove all macros?
Comment 2 Robert Großkopf 2020-02-15 16:02:47 UTC 
Wrong component. Have set this one to BASIC (not Base - the database).
Comment 3 Buovjaga 2020-05-09 14:04:34 UTC 
(In reply to Mike Kaganski from comment #1)
> ClamAV finds a macro; it has an entry for "Potentially Unwanted Application:
> document tool - LibreOffice Macro". What could be done for that? remove all
> macros?

Indeed, let's close