{"id":108766,"date":"2023-05-29T09:10:14","date_gmt":"2023-05-29T07:10:14","guid":{"rendered":"https:\/\/prohoster.info\/?p=108766"},"modified":"2023-05-29T09:39:13","modified_gmt":"2023-05-29T07:39:13","slug":"dve-uyazvimosti-v-libreoffice","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/dve-uyazvimosti-v-libreoffice","title":{"rendered":"Two Vulnerabilities in LibreOffice","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Information has been revealed about two vulnerabilities in the free office suite LibreOffice, the most dangerous of which could potentially allow code execution when opening a specially crafted document. The first vulnerability was quietly addressed in the March releases 7.4.6 and 7.5.1, while the second was fixed in the May updates of LibreOffice 7.4.7 and 7.5.3. <\/p>\n
The first vulnerability (CVE-2023-0950) potentially allows an attacker to execute their code in the system when opening a spreadsheet that includes specially crafted formulas, such as AGGREGATE, with fewer parameters than expected. The issue is caused by an index underflow in the formula parsing code (ScInterpreter) used in spreadsheet processing. <\/p>\n
The second vulnerability (CVE-2023-2255) allows an attacker to prepare a specially crafted document, when opened, it loads external links without prompting the user or providing a warning, which contradicts the expected behavior of LibreOffice, where a warning should be displayed when loading related content. This issue is caused by an oversight in the permission request code when using the 'Floating Frames' mechanism, similar to iframes in HTML, allowing dynamic inclusion of external file content in the document. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"