{"id":112563,"date":"2023-12-29T09:10:14","date_gmt":"2023-12-29T07:10:14","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/chetyre-uyazvimosti-v-apache-openoffice"},"modified":"2023-12-29T09:10:14","modified_gmt":"2023-12-29T07:10:14","slug":"chetyre-uyazvimosti-v-apache-openoffice","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/chetyre-uyazvimosti-v-apache-openoffice","title":{"rendered":"Four vulnerabilities in Apache OpenOffice","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
In the recently released version of the Apache OpenOffice 4.1.15 office suite, without any fanfare (information was disclosed a few days after the release and vulnerabilities were not initially mentioned in the change log), four vulnerabilities have been fixed: <\/p>\n
\n
The CVE-2023-1183 vulnerability allows for writing data to an arbitrary file in the system, depending on access rights, when specially crafted OBD (Office Binder Document) files are opened in OpenOffice Base. The attack is carried out by adding a file named «database\/script» with a SCRIPT command to the document, the contents of which are written to a new file whose path can be specified by the attacker.\n
The CVE-2012-5639 vulnerability allows the automatic downloading and opening of internal or external resources without warning the user. This vulnerability was identified in LibreOffice in 2012, but the issue report was closed as invalid. Nevertheless, the vulnerability was fixed in LibreOffice 4.2 in 2014, but went unnoticed in OpenOffice.\n
The CVE-2022-43680 vulnerability potentially allows for arbitrary code execution when opening specially crafted documents in situations where there is insufficient memory to process them. The vulnerability leads to accessing memory after it has been freed (Use after free) due to an error in the libexpat library used for parsing XML data. The issue has been fixed in libexpat 2.4.9.\n
The CVE-2023-47804 vulnerability allows placing a link in a document that triggers a macro with arbitrary arguments, enabling the execution of a script when the user clicks the link or when document-related events are automatically triggered without prior operation confirmation. This vulnerability defines a new attack vector for the CVE-2022-47502 issue, which was fixed in OpenOffice 4.1.14. <\/ul>\n