Apache OpenOffice: Remote document loaded without prompt, possibiy leaking environment variables

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would cause external links
to be loaded without prompt, possibly transferring the contents of environment variables in the process.

This issue affects Apache OpenOffice: through 4.1.16.

Users are recommended to upgrade to version 4.1.17, which fixes the issue.

Etkilenen sürümler1 yazılım

Kaynaklar4 kaynak

• CVE.org kaydı
• NVD kaydı
• lists.apache.org/thread.html/j19rrk8jwrlg41tj6rfdcccj8cyyxhz9 Üretici bülteni
• openwall.com/lists/oss-security/2026/11/03/30 Diğer

Kayıt geçmişi

1. 4 Kas 2026 17:00CVSS puanı değişti: – → 3.3
2. 4 Kas 2026 14:04Yayımlandı

İlgili açıklar

• 5,8 CVE-2026-59267Apache OpenOffice: Heap Buffer Overflow in DXF LWPOLYLINE import could cause memory corruption
• 7,3 CVE-2026-90634Apache OpenOffice: Out-of-bounds write when importing encrypted PDF files
• 7,3 CVE-2026-90629Apache OpenOffice: Out of bounds memory access during WMF import
• 7,3 CVE-2026-90628Apache OpenOffice: Stack overflow in CFF hint handling
• 5,5 CVE-2026-90627Apache OpenOffice: Local file inclusion via SQL provider and flat file database references
• 7,3 CVE-2026-90626Apache OpenOffice: Out-of-bounds write when importing encrypted PDF files