This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] LibreOffice fixes 2 vulnerabilities
LibreOffice fixes two vulnerabilities with version 24.8.4. Detailed information and a PoC for them are available at [1][2].
Using social engineering and a specially crafted "vnd.sun.star.expand" URL scheme, an unauthenticated remote attacker can read sensitive information such as password reset tokens, environment variables or configuration files and exfiltrate it to their own server [1][3]. The vulnerability can be exploited both when a user opens a malicious document on a desktop and when a document is processed automatically by a server without a graphical interface (headless) [1].
The vulnerability is present in product:
- *:LibreOffice;>=24.8,<24.8.4;
CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
More information:
- CVE-2024-12426 at cve.org, NVD
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor at cwe.mitre.org
The vulnerability was publicly disclosed 7. 1. 2025.
Due to insufficient path validation when processing embedded fonts, an unauthenticated remote attacker can, using social engineering, write an arbitrary file with the .ttf extension outside the designated temporary directory on the victim's system and keep it after the LibreOffice process terminates, which, when the document is processed automatically by a server, can potentially lead to privilege escalation or an XSS attack [1][4].
The vulnerability is present in product:
- *:LibreOffice;>=24.8,<24.8.4;
CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
More information:
- CVE-2024-12425 at cve.org, NVD
- CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') at cwe.mitre.org
The vulnerability was publicly disclosed 7. 1. 2025.
Links
By CESNET, z.s.p.o. Michaela Ručková on 26. 2. 2025.