Summary
SAC is a standard interface for CSS parsers, intended to work with CSS1, CSS2, CSS3 and other CSS derived languages.
Security Fix(es):
* libreoffice: heap buffer overflow in PDF import stream handling (CVE-2026-63274)
* libreoffice: stack buffer overflow in CFF to Type 1 font conversion (CVE-2026-63276)
* libreoffice: stack buffer overflow in CFF font hint handling (CVE-2026-63275)
* libreoffice: libreoffice: Arbitrary code execution via remote Java database driver (CVE-2026-63277)
Bug Fix(es) and Enhancement(s):
* [libbase] LibreOffice packages using EOL Java (after November 2026) (JIRA:Rocky Linux-275415)
* [flute] LibreOffice packages using EOL Java (after November 2026) (JIRA:Rocky Linux-275416)
* [libserializer] LibreOffice packages using EOL Java (after November 2026) (JIRA:Rocky Linux-275417)
* [libloader] LibreOffice packages using EOL Java (after November 2026) (JIRA:Rocky Linux-275418)
* [libformula] LibreOffice packages using EOL Java (after November 2026) (JIRA:Rocky Linux-275419)
* [librepository] LibreOffice packages using EOL Java (after November 2026) (JIRA:Rocky Linux-275420)
* [libfonts] LibreOffice packages using EOL Java (after November 2026) (JIRA:Rocky Linux-275421)
* [liblayout] LibreOffice packages using EOL Java (after November 2026) (JIRA:Rocky Linux-275422)
* [pentaho-libxml] LibreOffice packages using EOL Java (after November 2026) (JIRA:Rocky Linux-275423)
* [pentaho-reporting-flow-engine] LibreOffice packages using EOL Java (after November 2026) (JIRA:Rocky Linux-275424)
* [sac] LibreOffice packages using EOL Java (after November 2026) (JIRA:Rocky Linux-277813)
* [libreoffice] LibreOffice packages using EOL Java (after November 2026) (JIRA:Rocky Linux-260518)
* [Rocky Linux 8.10] Base Report Wizard fails with packaged Pentaho reporting engine (JIRA:Rocky Linux-286491)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 11
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 8 | flute | 0:1.3.0-19.OOo31.el8_10 |
| Rocky Linux · 8 | libbase | 0:1.1.3-21.el8_10 |
| Rocky Linux · 8 | libfonts | 0:1.1.3-23.el8_10 |
| Rocky Linux · 8 | libformula | 0:1.1.3-20.el8_10 |
| Rocky Linux · 8 | liblayout | 0:0.2.10-19.el8_10 |
| Rocky Linux · 8 | libloader | 0:1.1.3-19.el8_10 |
| Rocky Linux · 8 | libreoffice | 1:7.1.8.1-3.el8_10 |
| Rocky Linux · 8 | librepository | 0:1.1.3-19.el8_10 |
| Rocky Linux · 8 | libserializer | 0:1.1.2-20.el8_10 |
| Rocky Linux · 8 | pentaho-libxml | 0:1.1.3-20.el8_10 |
| Rocky Linux · 8 | pentaho-reporting-flow-engine | 1:0.9.4-17.el8_10 |
Vulnerabilities 4
-
High 8.5CVE-2026-63277 Public exploit
RCE via calcext:data-mappings, sql provider and jdbc connector
LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A document could name a Java database driver for such a link to be loaded from a remote location, so opening the document could run Java code from that l…
-
Medium 5.4
Heap buffer overflow in PDF import stream handling
LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing a stream object. The length of the stream was taken from the object's own dictionary and was not checked against the number of bytes actually present, so copying the stre…
-
Medium 5.4
Stack buffer overflow in CFF font hint handling
LibreOffice can read CFF fonts, which may be embedded in documents. A stack buffer overflow existed when reading the hints of a glyph. The number of hints was checked against the wrong bound, so a glyph declaring more hints than the array can hold wrote past …
-
Medium 5.4
Stack buffer overflow in CFF to Type 1 font conversion
LibreOffice converts CFF fonts to Type 1 when it subsets a font, which happens when a document is exported to PDF, and CFF fonts may be embedded in documents. A stack buffer overflow existed in that conversion. The converted operators were written into a fixe…