Debian Libreoffice vulnerabilities

CVE-2024-3044 [MEDIUM] CVE-2024-3044: libreoffice - Unchecked script execution in Graphic on-click binding in affected LibreOffice v... Unchecked script execution in Graphic on-click binding in affected LibreOffice versions allows an attacker to create a document which without prompt will execute scripts built-into LibreOffice on clicking a graphic. Such scripts were previously deemed trusted but are now deemed untrusted. Scope: local bookworm: resolved (fixed in 4:7.4.7-1+deb12u2) bullseye: res

CVE-2016-0794 [HIGH] CVE-2016-0794: libreoffice - The lwp filter in LibreOffice before 5.0.4 allows remote attackers to cause a de... The lwp filter in LibreOffice before 5.0.4 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted LotusWordPro (lwp) document. Scope: local bookworm: resolved (fixed in 1:5.0.5~rc1-1) bullseye: resolved (fixed in 1:5.0.5~rc1-1) forky: resolved (fixed in 1:5.0.5~rc1-1) sid: resolved (fixed in

CVE-2018-10119 [HIGH] CVE-2018-10119: libreoffice - sot/source/sdstor/stgstrms.cxx in LibreOffice before 5.4.5.1 and 6.x before 6.0.... sot/source/sdstor/stgstrms.cxx in LibreOffice before 5.4.5.1 and 6.x before 6.0.1.1 uses an incorrect integer data type in the StgSmallStrm class, which allows remote attackers to cause a denial of service (use-after-free with write access) or possibly have unspecified other impact via a crafted document that uses the structured storage ole2 wrapper file format.

CVE-2024-7788 [HIGH] CVE-2024-7788: libreoffice - Improper Digital Signature Invalidation  vulnerability in Zip Repair Mode of The... Improper Digital Signature Invalidation vulnerability in Zip Repair Mode of The Document Foundation LibreOffice allows Signature forgery vulnerability in LibreOfficeThis issue affects LibreOffice: from 24.2 before < 24.2.5. Scope: local bookworm: resolved (fixed in 4:7.4.7-1+deb12u5) bullseye: resolved (fixed in 1:7.0.4-4+deb11u11) forky: resolved (fixed in 4:24.2

CVE-2020-12803 [MEDIUM] CVE-2020-12803: libreoffice - ODF documents can contain forms to be filled out by the user. Similar to HTML fo... ODF documents can contain forms to be filled out by the user. Similar to HTML forms, the contained form data can be submitted to a URI, for example, to an external web server. To create submittable forms, ODF implements the XForms W3C standard, which allows data to be submitted without the need for macros or other active scripting Prior to version 6.4.4 LibreO

CVE-2024-12426 [MEDIUM] CVE-2024-12426: libreoffice - Exposure of Environmental Variables and arbitrary INI file values to an Unauthor... Exposure of Environmental Variables and arbitrary INI file values to an Unauthorized Actor vulnerability in The Document Foundation LibreOffice. URLs could be constructed which expanded environmental variables or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document containing such links. This issue

CVE-2017-12608 [HIGH] CVE-2017-12608: libreoffice - A vulnerability in Apache OpenOffice Writer DOC file parser before 4.1.4, and sp... A vulnerability in Apache OpenOffice Writer DOC file parser before 4.1.4, and specifically in ImportOldFormatStyles, allows attackers to craft malicious documents that cause denial of service (memory corruption and application crash) potentially resulting in arbitrary code execution. Scope: local bookworm: resolved (fixed in 1:5.0.2-1) bullseye: resolved (fixed

CVE-2016-0795 [HIGH] CVE-2016-0795: libreoffice - LibreOffice before 5.0.5 allows remote attackers to cause a denial of service (m... LibreOffice before 5.0.5 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted LwpTocSuperLayout record in a LotusWordPro (lwp) document. Scope: local bookworm: resolved (fixed in 1:5.0.5~rc1-1) bullseye: resolved (fixed in 1:5.0.5~rc1-1) forky: resolved (fixed in 1:5.0.5~rc1-1) sid: resolv

CVE-2017-12607 [HIGH] CVE-2017-12607: libreoffice - A vulnerability in OpenOffice's PPT file parser before 4.1.4, and specifically i... A vulnerability in OpenOffice's PPT file parser before 4.1.4, and specifically in PPTStyleSheet, allows attackers to craft malicious documents that cause denial of service (memory corruption and application crash) potentially resulting in arbitrary code execution. Scope: local bookworm: resolved (fixed in 1:5.0.2-1) bullseye: resolved (fixed in 1:5.0.2-1) forky:

CVE-2017-9806 [HIGH] CVE-2017-9806: libreoffice - A vulnerability in the OpenOffice Writer DOC file parser before 4.1.4, and speci... A vulnerability in the OpenOffice Writer DOC file parser before 4.1.4, and specifically in the WW8Fonts Constructor, allows attackers to craft malicious documents that cause denial of service (memory corruption and application crash) potentially resulting in arbitrary code execution. Scope: local bookworm: resolved (fixed in 1:3.4.3-1) bullseye: resolved (fixed in

CVE-2023-2255 [MEDIUM] CVE-2023-2255: libreoffice - Improper access control in editor components of The Document Foundation LibreOff... Improper access control in editor components of The Document Foundation LibreOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt. In the affected versions of LibreOffice documents that used "floating frames" linked to external files, would load the contents of those frames without prompting the user for perm

CVE-2020-12802 [MEDIUM] CVE-2020-12802: libreoffice - LibreOffice has a 'stealth mode' in which only documents from locations deemed '... LibreOffice has a 'stealth mode' in which only documents from locations deemed 'trusted' are allowed to retrieve remote resources. This mode is not the default mode, but can be enabled by users who want to disable LibreOffice's ability to include remote resources within a document. A flaw existed where remote graphic links loaded from docx documents were omitt

CVE-2013-2189 [MEDIUM] CVE-2013-2189: libreoffice - Apache OpenOffice.org (OOo) before 4.0 allows remote attackers to cause a denial... Apache OpenOffice.org (OOo) before 4.0 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via invalid PLCF data in a DOC document file. Scope: local bookworm: resolved (fixed in 1:3.4.3-1) bullseye: resolved (fixed in 1:3.4.3-1) forky: resolved (fixed in 1:3.4.3-1) sid: resolved (fixed in 1:3.4.3-1)

CVE-2013-4156 [MEDIUM] CVE-2013-4156: libreoffice - Apache OpenOffice.org (OOo) before 4.0 allows remote attackers to cause a denial... Apache OpenOffice.org (OOo) before 4.0 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted element in an OOXML document file. Scope: local bookworm: resolved (fixed in 1:4.1.0-1) bullseye: resolved (fixed in 1:4.1.0-1) forky: resolved (fixed in 1:4.1.0-1) sid: resolved (fixed in 1:4.1.0

CVE-2020-12801 [MEDIUM] CVE-2020-12801: libreoffice - If LibreOffice has an encrypted document open and crashes, that document is auto... If LibreOffice has an encrypted document open and crashes, that document is auto-saved encrypted. On restart, LibreOffice offers to restore the document and prompts for the password to decrypt it. If the recovery is successful, and if the file format of the recovered document was not LibreOffice's default ODF file format, then affected versions of LibreOffice

CVE-2015-4551 [MEDIUM] CVE-2015-4551: libreoffice - LibreOffice before 4.4.5 and Apache OpenOffice before 4.1.2 uses the stored Link... LibreOffice before 4.4.5 and Apache OpenOffice before 4.1.2 uses the stored LinkUpdateMode configuration information in OpenDocument Format files and templates when handling links, which might allow remote attackers to obtain sensitive information via a crafted document, which embeds data from local files into (1) Calc or (2) Writer. Scope: local bookworm: resol

CVE-2017-3157 [MEDIUM] CVE-2017-3157: libreoffice - By exploiting the way Apache OpenOffice before 4.1.4 renders embedded objects, a... By exploiting the way Apache OpenOffice before 4.1.4 renders embedded objects, an attacker could craft a document that allows reading in a file from the user's filesystem. Information could be retrieved by the attacker by, e.g., using hidden sections to store the information, tricking the user into saving the document and convincing the user to send the document

CVE-2019-9849 [MEDIUM] CVE-2019-9849: libreoffice - LibreOffice has a 'stealth mode' in which only documents from locations deemed '... LibreOffice has a 'stealth mode' in which only documents from locations deemed 'trusted' are allowed to retrieve remote resources. This mode is not the default mode, but can be enabled by users who want to disable LibreOffice's ability to include remote resources within a document. A flaw existed where bullet graphics were omitted from this protection prior to v

CVE-2025-2866 [LOW] CVE-2025-2866: libreoffice - Improper Verification of Cryptographic Signature vulnerability in LibreOffice al... Improper Verification of Cryptographic Signature vulnerability in LibreOffice allows PDF Signature Spoofing by Improper Validation. In the affected versions of LibreOffice a flaw in the verification code for adbe.pkcs7.sha1 signatures could cause invalid signatures to be accepted as valid This issue affects LibreOffice: from 24.8 before < 24.8.6, from 25.2 before <

CVE-2012-4233 [MEDIUM] CVE-2012-4233: libreoffice - LibreOffice 3.5.x before 3.5.7.2 and 3.6.x before 3.6.1, and OpenOffice.org (OOo... LibreOffice 3.5.x before 3.5.7.2 and 3.6.x before 3.6.1, and OpenOffice.org (OOo), allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted (1) odt file to vcllo.dll, (2) ODG (Drawing document) file to svxcorelo.dll, (3) PolyPolygon record in a .wmf (Window Meta File) file embedded in a ppt (PowerPoint) file to tllo.dll, or (