LibreOffice before 4.4.5 and Apache OpenOffice before 4.1.2 uses the stored LinkUpdateMode configuration information in OpenDocument Format

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• apache openofficeup to 4.1.1 inclusive
• canonical ubuntu linux12.04
• canonical ubuntu linux14.04
• canonical ubuntu linux15.04
• debian debian linux7.0
• debian debian linux8.0
• libreoffice libreofficeup to 4.4.4 inclusive

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2019-9851LibreLogo global-event script execution
  62This week
• CVE-2018-16858It was found that libreoffice before versions 6.0.7 and 6.1.3 was vulnerable to a directory traversal attack which could be used to execute
  59Plan
• CVE-2018-10583An information disclosure vulnerability occurs when LibreOffice 6.0.3 and Apache OpenOffice Writer 4.1.5 automatically process and initiate
  54Plan
• CVE-2019-9848LibreOffice has a feature where documents can specify that pre-installed scripts can be executed on various document events such as mouse-ov
  48Plan
• CVE-2018-6871LibreOffice before 5.4.5 and 6.x before 6.0.1 allows remote attackers to read arbitrary files via =WEBSERVICE calls in a document, which use
  46Plan
• CVE-2023-1183Arbitrary file write
  41Plan

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

The extension requests broader permissions than its function needs and sends the data it collects out for purposes beyond its stated function.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1{2  "permissions": ["tabs", "<all_urls>"],3  "background": { "service_worker": "analytics.js" }4}

1{2  "permissions": ["activeTab"],3  "host_permissions": ["https://yildiz.example/*"]4}

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.