Information has been revealed about two vulnerabilities in the free office suite LibreOffice, the most dangerous of which could potentially allow code execution when opening a specially crafted document. The first vulnerability was quietly addressed in the March releases 7.4.6 and 7.5.1, while the second was fixed in the May updates of LibreOffice 7.4.7 and 7.5.3.
The first vulnerability (CVE-2023-0950) potentially allows an attacker to execute their code in the system when opening a spreadsheet that includes specially crafted formulas, such as AGGREGATE, with fewer parameters than expected. The issue is caused by an index underflow in the formula parsing code (ScInterpreter) used in spreadsheet processing.
The second vulnerability (CVE-2023-2255) allows an attacker to prepare a specially crafted document that loads external links upon opening without any prompts or warnings, which is contrary to the expected behavior of LibreOffice that should warn the user when loading linked content. The issue is due to a flaw in the authority request code when using the Floating Frames mechanism, similar to iframes in HTML, which allows dynamic inclusion of external file content into the document.
Source: opennet.ru
