Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

rocky логотип

RLSA-2026:88164

Опубликовано: 23 окт. 2026
Источник: rocky
Оценка: Important

Описание

Important: flute, libbase, libfonts, libformula, liblayout, libloader, libreoffice, librepository, libserializer, pentaho-libxml, pentaho-reporting-flow-engine, and sac security, bug fix, and enhancement update

SAC is a standard interface for CSS parsers, intended to work with CSS1, CSS2, CSS3 and other CSS derived languages.

Security Fix(es):

  • libreoffice: heap buffer overflow in PDF import stream handling (CVE-2026-63274)

  • libreoffice: stack buffer overflow in CFF to Type 1 font conversion (CVE-2026-63276)

  • libreoffice: stack buffer overflow in CFF font hint handling (CVE-2026-63275)

  • libreoffice: libreoffice: Arbitrary code execution via remote Java database driver (CVE-2026-63277)

Bug Fix(es) and Enhancement(s):

  • [libbase] LibreOffice packages using EOL Java (after November 2026) (JIRA:Rocky Linux-275415)

  • [flute] LibreOffice packages using EOL Java (after November 2026) (JIRA:Rocky Linux-275416)

  • [libserializer] LibreOffice packages using EOL Java (after November 2026) (JIRA:Rocky Linux-275417)

  • [libloader] LibreOffice packages using EOL Java (after November 2026) (JIRA:Rocky Linux-275418)

  • [libformula] LibreOffice packages using EOL Java (after November 2026) (JIRA:Rocky Linux-275419)

  • [librepository] LibreOffice packages using EOL Java (after November 2026) (JIRA:Rocky Linux-275420)

  • [libfonts] LibreOffice packages using EOL Java (after November 2026) (JIRA:Rocky Linux-275421)

  • [liblayout] LibreOffice packages using EOL Java (after November 2026) (JIRA:Rocky Linux-275422)

  • [pentaho-libxml] LibreOffice packages using EOL Java (after November 2026) (JIRA:Rocky Linux-275423)

  • [pentaho-reporting-flow-engine] LibreOffice packages using EOL Java (after November 2026) (JIRA:Rocky Linux-275424)

  • [sac] LibreOffice packages using EOL Java (after November 2026) (JIRA:Rocky Linux-277813)

  • [libreoffice] LibreOffice packages using EOL Java (after November 2026) (JIRA:Rocky Linux-260518)

  • [Rocky Linux 8.10] Base Report Wizard fails with packaged Pentaho reporting engine (JIRA:Rocky Linux-286491)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Затронутые продукты

  • Rocky Linux 8

НаименованиеАрхитектураРелизRPM
autocorr-esnoarch3.el8_10autocorr-es-7.1.8.1-3.el8_10.noarch.rpm
autocorr-afnoarch3.el8_10autocorr-af-7.1.8.1-3.el8_10.noarch.rpm
autocorr-bgnoarch3.el8_10autocorr-bg-7.1.8.1-3.el8_10.noarch.rpm
autocorr-canoarch3.el8_10autocorr-ca-7.1.8.1-3.el8_10.noarch.rpm
autocorr-csnoarch3.el8_10autocorr-cs-7.1.8.1-3.el8_10.noarch.rpm
autocorr-danoarch3.el8_10autocorr-da-7.1.8.1-3.el8_10.noarch.rpm
autocorr-denoarch3.el8_10autocorr-de-7.1.8.1-3.el8_10.noarch.rpm
autocorr-elnoarch3.el8_10autocorr-el-7.1.8.1-3.el8_10.noarch.rpm
autocorr-ennoarch3.el8_10autocorr-en-7.1.8.1-3.el8_10.noarch.rpm
autocorr-fanoarch3.el8_10autocorr-fa-7.1.8.1-3.el8_10.noarch.rpm

Показывать по

Связанные CVE

CVE-2026-63274
CVE-2026-63275
CVE-2026-63276
CVE-2026-63277

Ссылки на источники

Исправления

Связанные уязвимости

rocky логотип

RLSA-2026:82013

rocky
13 дней назад

Important: libreoffice security update

oracle-oval логотип

ELSA-2026-82013

oracle-oval
14 дней назад

ELSA-2026-82013: libreoffice security update (IMPORTANT)

ubuntu логотип

CVE-2026-63274

ubuntu
около 1 месяца назад

LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing a stream object. The length of the stream was taken from the object's own dictionary and was not checked against the number of bytes actually present, so copying the stream read and wrote past the end of the buffer holding it. In fixed versions the declared length is clamped to the bytes actually read.

redhat логотип

CVE-2026-63274

CVSS3: 7.3
redhat
около 1 месяца назад

LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing a stream object. The length of the stream was taken from the object's own dictionary and was not checked against the number of bytes actually present, so copying the stream read and wrote past the end of the buffer holding it. In fixed versions the declared length is clamped to the bytes actually read.

nvd логотип

CVE-2026-63274

nvd
около 1 месяца назад

LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing a stream object. The length of the stream was taken from the object's own dictionary and was not checked against the number of bytes actually present, so copying the stream read and wrote past the end of the buffer holding it. In fixed versions the declared length is clamped to the bytes actually read.