Information has been revealed about two vulnerabilities in the free office suite LibreOffice, with the most dangerous potentially allowing code execution when opening a specially crafted document. The first vulnerability was quietly fixed in the March releases 7.4.6 and 7.5.1, while the second was addressed in the May updates of LibreOffice 7.4.7 and 7.5.3.
The first vulnerability (CVE-2023-0950) potentially allows an attacker to execute their code in the system when opening a spreadsheet that includes specially modified formulas, such as AGGREGATE, which have fewer parameters than expected. The issue is caused by an array index underflow in the formula parsing code (ScInterpreter) used when processing spreadsheets.
The second vulnerability (CVE-2023-2255) allows an attacker to create a specially crafted document that, when opened, loads external links without prompting or warning, which is inconsistent with the expected behavior of LibreOffice, where a warning should be displayed when loading linked content. The problem arises from a flaw in the authorization request code when using the 'Floating Frames' mechanism, similar to iframes in HTML, which allows dynamically including content from external files in the document.
Källa: opennet.ru
