Summary
Thomas Rinsma discovered that LibreOffice incorrectly handled paths when
processing embedded font files. If a user or automated system were tricked
into opening a specially crafted LibreOffice file, a remote attacker could
possibly use this issue to create arbitrary files ending with ".ttf".
(CVE-2024-12425)
Thomas Rinsma discovered that LibreOffice incorrectly handled certain
environment variables and INI file values. If a user or automated system
were tricked into opening a specially crafted LibreOffice file, a remote
attacker could possibly use this issue to exfiltrate sensitive information.
(CVE-2024-12426)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | libreoffice | 1:6.4.7-0ubuntu0.20.04.13 |
| Ubuntu · 22.04 LTS 22.04:LTS | libreoffice | 1:7.3.7-0ubuntu0.22.04.8 |
| Ubuntu · 24.04 LTS 24.04:LTS | libreoffice | 4:24.2.7-0ubuntu0.24.04.2 |
Vulnerabilities 2
-
Medium 6.7
URL fetching can be used to exfiltrate arbitrary INI file values and environment variables
Exposure of Environmental Variables and arbitrary INI file values to an Unauthorized Actor vulnerability in The Document Foundation LibreOffice. URLs could be constructed which expanded environmental variables or INI file values, so potentially sensitive info…
-
Low 2.4
Path traversal leading to arbitrary .ttf file write
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The Document Foundation LibreOffice allows Absolute Path Traversal. An attacker can write to arbitrary locations, albeit suffixed with ".ttf", by supplying a file …