Описание
LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A document could name a Java database driver for such a link to be loaded from a remote location, so opening the document could run Java code from that location. In fixed versions an entry in a Java class path has to be a file URL.
A flaw was found in LibreOffice. When linking spreadsheet cell ranges to external data sources in Calc, a document can specify an external Java database driver. By convincing a user to open a specially crafted document, a remote attacker can force the application to download and execute untrusted Java code from a remote location, resulting in arbitrary code execution.
Отчет
Vulnerability in LibreOffice Calc allows execution of untrusted Java code via remote Java database driver paths in spreadsheet cell range links. When an attacker tricks a user into opening a specially crafted spreadsheet document, Calc downloads and executes arbitrary remote Java code under the security context of the logged-in user.
Меры по смягчению последствий
Restricting the LibreOffice Java class path settings to local file system schemes (file:// URLs) prevents the execution of untrusted code from remote network locations. Alternatively, disabling the Java Runtime Environment (JRE) in LibreOffice options (Tools -> Options -> LibreOffice -> Advanced) eliminates the attack vector.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | libreoffice | Affected | ||
| Red Hat Enterprise Linux 7 | libreoffice | Affected | ||
| Red Hat Enterprise Linux 8 | flute | Fixed | RHSA-2026:88164 | 22.10.2026 |
| Red Hat Enterprise Linux 8 | libbase | Fixed | RHSA-2026:88164 | 22.10.2026 |
| Red Hat Enterprise Linux 8 | libfonts | Fixed | RHSA-2026:88164 | 22.10.2026 |
| Red Hat Enterprise Linux 8 | libformula | Fixed | RHSA-2026:88164 | 22.10.2026 |
| Red Hat Enterprise Linux 8 | liblayout | Fixed | RHSA-2026:88164 | 22.10.2026 |
| Red Hat Enterprise Linux 8 | libloader | Fixed | RHSA-2026:88164 | 22.10.2026 |
| Red Hat Enterprise Linux 8 | libreoffice | Fixed | RHSA-2026:88164 | 22.10.2026 |
| Red Hat Enterprise Linux 8 | librepository | Fixed | RHSA-2026:88164 | 22.10.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
7.8 High
CVSS3
Связанные уязвимости
LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A document could name a Java database driver for such a link to be loaded from a remote location, so opening the document could run Java code from that location. In fixed versions an entry in a Java class path has to be a file URL.
LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A document could name a Java database driver for such a link to be loaded from a remote location, so opening the document could run Java code from that location. In fixed versions an entry in a Java class path has to be a file URL.
LibreOffice Calc can link a cell range to an external data source, and ...
LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A document could name a Java database driver for such a link to be loaded from a remote location, so opening the document could run Java code from that location. In fixed versions an entry in a Java class path has to be a file URL.
Important: flute, libbase, libfonts, libformula, liblayout, libloader, libreoffice, librepository, libserializer, pentaho-libxml, pentaho-reporting-flow-engine, and sac security, bug fix, and enhancement update
EPSS
7.8 High
CVSS3