BSD Portslibreoffice -- Macro URL arbitrary script execution
[email protected] reports: LibreOffice supports Office URI Schemes to enable browser integration of LibreOffice with MS SharePoint server. An additional scheme 'vnd.libreoffice.command' specific to LibreOffice was added. In the affected versions of LibreOffice a link in a browser using that scheme could be constructed with an embedded inner URL that when passed to LibreOffice could call internal macros …
Affected versions
- libreoffice >= 24.8 < 24.8.5; >= 25.2 < 25.2.1
By system
0 still vulnerable, 2 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| DragonFly | editors/libreoffice | 25.2.2.2 | fixed | |
| OpenBSD | editors/libreoffice | 26.8.0.3v0 | out of range, by version | |
| MidnightBSD | editors/libreoffice | out of range, by version | ||
| FreeBSD | editors/libreoffice | 26.8.1.1 | fixed |