Information disclosure in LibreOffice - CVE-2024-12426

Vulnerability identifier: #VU102417

CSH Severity: Medium

CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-12426

CWE-ID: CWE-200

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to application allows to dynamically create links to external websites using information from environmental variables or INI file values. A remote attacker can trick the victim into opening a specially crafted documents and then clicking on the link in that document to gain access to potentially sensitive information.

LibreOffice
Debian Linux
Gentoo Linux
Ubuntu
app-office/libreoffice
app-office/libreoffice-bin
libreoffice (Ubuntu package)
libreoffice (Debian package)

Install updates from vendor's website.

LibreOffice - update to 24.8.4.1
app-office/libreoffice - update to 24.2.7.2-r1
app-office/libreoffice-bin - update to 24.8.4
libreoffice (Ubuntu package) - addressed in versions 1:6.4.7-0ubuntu0.20.04.13, 1:7.3.7-0ubuntu0.22.04.8, 4:24.2.7-0ubuntu0.24.04.2, 4:24.8.4-0ubuntu0.24.10.2
libreoffice (Debian package) - addressed in versions 4:7.4.7-1+deb12u6, 4:25.2.3-2+deb13u7

• https://www.libreoffice.org/about-us/security/advisories/cve-2024-12426/

• Multiple vulnerabilities in LibreOffice
• Debian update for libreoffice
• Ubuntu update for libreoffice
• Gentoo update for LibreOffice
• Debian update for libreoffice