Skip to content
OpenAdvisories
Medium DLA-4020-1 2 CVEs

libreoffice - security update

Published Jan 19, 2025 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 11 libreoffice 1:7.0.4-4+deb11u12

Vulnerabilities 2

  • Medium 6.7
    CVE-2024-12426

    URL fetching can be used to exfiltrate arbitrary INI file values and environment variables

    Exposure of Environmental Variables and arbitrary INI file values to an Unauthorized Actor vulnerability in The Document Foundation LibreOffice. URLs could be constructed which expanded environmental variables or INI file values, so potentially sensitive info…

    The Document Foundation LibreOffice libreoffice libreoffice Debian Ubuntu
  • Low 2.4
    CVE-2024-12425

    Path traversal leading to arbitrary .ttf file write

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The Document Foundation LibreOffice allows Absolute Path Traversal. An attacker can write to arbitrary locations, albeit suffixed with ".ttf", by supplying a file …

    The Document Foundation LibreOffice libreoffice libreoffice Debian Ubuntu