Skip to content
OpenAdvisories
High WID-SEC-2025-2577 7 CVEs

Apache OpenOffice: Mehrere Schwachstellen

Published Nov 11, 2025 · Updated Nov 12, 2025 · Revision 2 · de-DE

Vendor: Apache Product: OpenOffice Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Apache OpenOffice ausnutzen, um vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen und eine Speicherbeschädigung durchzuführen, was zur Ausführung von beliebigem Code führen könnte.

Product

OpenOffice ist ein OpenSource Programmpaket von Apache mit zahlreichen Office-Anwendugen. Es enthält Programme zur Textverarbeitung, Tabellenkalkulation, Präsentation, Zeichnungen sowie eine Datenbank.

Vulnerabilities 7

  • High 8.1
    CVE-2025-64403

    Apache OpenOffice: Remote documents loaded without prompt via "external data sources" in Calc

    Apache OpenOffice Calc spreadsheet can contain links to other files, in the form of "external data sources". A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would cause such links to be loaded without pr…

    Apache Software Foundation Apache OpenOffice
  • High 7.5
    CVE-2025-64401

    Apache OpenOffice: Remote documents loaded without prompt via IFrame

    Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt. In the affected versions of Apache OpenOffice, docum…

    Apache Software Foundation Apache OpenOffice
  • High 7.5
    CVE-2025-64404

    Apache OpenOffice: Remote documents loaded without prompt via background and bullet images

    Apache OpenOffice documents can contain links to other files. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt. In the affected versions of Apache Op…

    Apache Software Foundation Apache OpenOffice
  • High 7.5
    CVE-2025-64405

    Apache OpenOffice: Remote documents loaded without prompt via DDE function

    Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt. In the affected versions of Apache OpenOffice, Calc …

    Apache Software Foundation Apache OpenOffice
  • Medium 6.5
    CVE-2025-64402

    Apache OpenOffice: Remote documents loaded without prompt via OLE objects

    Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt. In the affected versions of Apache OpenOffice, docum…

    Apache Software Foundation Apache OpenOffice
  • Medium 5.3
    CVE-2025-64407

    Apache OpenOffice: URL fetching can be used to exfiltrate arbitrary INI file values and environment variables

    Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt. Such links could also be used to transmit system inf…

    Apache Software Foundation Apache OpenOffice
  • Medium 4.3
    CVE-2025-64406

    Apache OpenOffice: Possible memory corruption during CSV import

    An out-of-bounds Write vulnerability in Apache OpenOffice could allow an attacker to craft a document that would crash the program, or otherwise corrupt other memory areas. This issue affects Apache OpenOffice: through 4.1.15. Users are recommended to upgrade…

    Apache Software Foundation Apache OpenOffice

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2025-119983, EUVD-2025-124971, EUVD-2025-124972, EUVD-2025-124979, EUVD-2025-124980, EUVD-2025-124981, EUVD-2025-124973

  2. #1

    Initiale Fassung

References