OP
Product
Openoffice
60
CVEs
0
On KEV
8.8
Max CVSS
0
New 30D
Severity mix
Critical 0High 25Medium 8Low 0
Watch
Add Openoffice to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-47804 | 8.8 | Dec 29 | Apache OpenOffice documents can contain links that call internal macros with arbitrary arguments Affected: before 4.1.15 |
| CVE-2022-37401 | 8.8 | Aug 15 | Apache OpenOffice supports the storage of passwords for web connections in the user's configuration database Affected: before 4.1.13 |
| CVE-2022-37400 | 8.8 | Aug 15 | Apache OpenOffice supports the storage of passwords for web connections in the user's configuration database Affected: before 4.1.13 |
| CVE-2021-30245 | 8.8 | Apr 15 | The project received a report that all versions of Apache OpenOffice through 4.1.8 can open non-http(s) hyperlinks Affected: through 4.1.8 |
| CVE-2025-64403 | 8.1 | Nov 12 | Apache OpenOffice Calc spreadsheet can contain links to other files, in the form of "external data sources" Affected: before 4.1.16 |
| CVE-2022-47502 | 7.8 | Mar 24 | Apache OpenOffice documents can contain links that call internal macros with arbitrary arguments Affected: through 4.1.13 |
| CVE-2022-38745 | 7.8 | Mar 24 | Apache OpenOffice versions before 4.1.14 may be configured to add an empty entry to the Java class path Affected: before 4.1.14 |
| CVE-2021-28129 | 7.8 | Oct 7 | While working on Apache OpenOffice 4.1.8 a developer discovered that the DEB package did not install using root, but instead used a userid and groupid of 500 Affected: 4.1.8 |
| CVE-2021-33035 | 7.8 | Sep 23 | Apache OpenOffice opens dBase/DBF documents and shows the contents as spreadsheets Affected: through 4.1.10 |
| CVE-2020-13958 | 7.8 | Nov 17 | A vulnerability in Apache OpenOffice scripting events allows an attacker to construct documents containing hyperlinks pointing to an executable on the target users file system Affected: 4.0.0 before 4.1.8 |
| CVE-2011-2177 | 7.8 | Nov 27 | OpenOffice.org v3.3 allows execution of arbitrary code with the privileges of the user running the OpenOffice.org suite tools Affected: 3.3.0 |
| CVE-2018-11790 | 7.8 | Jan 31 | When loading a document with Apache Open Office 4.1.5 and earlier with smaller end line termination than the operating system uses, the defect occurs Affected: through 4.1.5 |
| CVE-2017-12608 | 7.8 | Nov 20 | A vulnerability in Apache OpenOffice Writer DOC file parser before 4.1.4, and specifically in ImportOldFormatStyles, allows attackers to craft malicious documents that cause… Affected: before 4.1.4 |
| CVE-2017-12607 | 7.8 | Nov 20 | A vulnerability in OpenOffice's PPT file parser before 4.1.4, and specifically in PPTStyleSheet, allows attackers to craft malicious documents that cause denial of service (memory… Affected: before 4.1.4 |
| CVE-2017-9806 | 7.8 | Nov 20 | A vulnerability in the OpenOffice Writer DOC file parser before 4.1.4, and specifically in the WW8Fonts Constructor, allows attackers to craft malicious documents that cause… Affected: before 4.1.4 |
| CVE-2016-6804 | 7.8 | Nov 20 | The Apache OpenOffice installer (versions prior to 4.1.3, including some branded as OpenOffice.org) for Windows contains a defective operation that allows execution of arbitrary… Affected: before 4.1.3 |
| CVE-2016-6803 | 7.8 | Nov 13 | An installer defect known as an "unquoted Windows search path vulnerability" affected the Apache OpenOffice before 4.1.3 installers for Windows Affected: through 4.1.2 |
| CVE-2016-1513 | 7.8 | Aug 5 | The Impress tool in Apache OpenOffice 4.1.2 and earlier allows remote attackers to cause a denial of service (out-of-bounds read or write) or execute arbitrary code via crafted… Affected: through 4.1.2 |
| CVE-2008-3282 | 7.8 | Aug 29 | Integer overflow in the rtl_allocateMemory function in sal/rtl/source/alloc_global.c in the memory allocator in OpenOffice.org (OOo) 2.4.1, on 64-bit platforms, allows remote… Affected: 2.4.1 |
| CVE-2025-64405 | 7.5 | Nov 12 | Apache OpenOffice documents can contain links Affected: before 4.1.16 |
| CVE-2025-64404 | 7.5 | Nov 12 | Apache OpenOffice documents can contain links to other files Affected: before 4.1.16 |
| CVE-2025-64401 | 7.5 | Nov 12 | Apache OpenOffice documents can contain links Affected: before 4.1.16 |
| CVE-2021-41832 | 7.5 | Oct 11 | It is possible for an attacker to manipulate documents to appear to be signed by a trusted source Affected: before 4.1.11 |
| CVE-2021-41830 | 7.5 | Oct 11 | It is possible for an attacker to manipulate signed documents and macros to appear to come from a trusted source Affected: before 4.1.11 |
| CVE-2018-10583 | 7.5 | May 1 | An information disclosure vulnerability occurs when LibreOffice 6.0.3 and Apache OpenOffice Writer 4.1.5 automatically process and initiate an SMB connection embedded in a… Affected: 4.1.5 |
| CVE-2025-64402 | 6.5 | Nov 12 | Apache OpenOffice documents can contain links Affected: before 4.1.16 |
| CVE-2021-40439 | 6.5 | Oct 7 | Apache OpenOffice has a dependency on expat software Affected: through 4.1.10 |
| CVE-2012-5639 | 6.5 | Dec 20 | LibreOffice and OpenOffice automatically open embedded content Affected: All versions, or not specified |
| CVE-2012-0037 | 6.5 | Jun 17 | Redland Raptor (aka libraptor) before 2.0.7, as used by OpenOffice 3.3 and 3.4 Beta, LibreOffice before 3.4.6 and 3.5.x before 3.5.1, and other products, allows user-assisted… Affected: 3.3.0; 3.4.0 |
| CVE-2017-3157 | 5.5 | Nov 20 | By exploiting the way Apache OpenOffice before 4.1.4 renders embedded objects, an attacker could craft a document that allows reading in a file from the user's filesystem Affected: through 4.1.3 |
| CVE-2025-64407 | 5.3 | Nov 12 | Apache OpenOffice documents can contain links Affected: before 4.1.16 |
| CVE-2021-41831 | 5.3 | Oct 11 | It is possible for an attacker to manipulate the timestamp of signed documents Affected: before 4.1.11 |
| CVE-2025-64406 | 4.3 | Nov 12 | An out-of-bounds Write vulnerability in Apache OpenOffice could allow an attacker to craft a document that would crash the program, or otherwise corrupt other memory areas Affected: before 4.1.16 |
| CVE-2015-5214 | – | Nov 10 | LibreOffice before 4.4.6 and 5.x before 5.0.1 and Apache OpenOffice before 4.1.2 allows remote attackers to cause a denial of service (memory corruption and application crash) or… Affected: through 4.1.1 |
| CVE-2015-5213 | – | Nov 10 | Integer overflow in LibreOffice before 4.4.5 and Apache OpenOffice before 4.1.2 allows remote attackers to cause a denial of service (memory corruption and application crash) or… Affected: through 4.1.1 |
| CVE-2015-5212 | – | Nov 10 | Integer underflow in LibreOffice before 4.4.5 and Apache OpenOffice before 4.1.2, when the configuration setting "Load printer settings with the document" is enabled, allows… Affected: through 4.1.1 |
| CVE-2015-4551 | – | Nov 10 | LibreOffice before 4.4.5 and Apache OpenOffice before 4.1.2 uses the stored LinkUpdateMode configuration information in OpenDocument Format files and templates when handling… Affected: through 4.1.1 |
| CVE-2015-1774 | – | Apr 28 | The HWP filter in LibreOffice before 4.3.7 and 4.4.x before 4.4.2 and Apache OpenOffice before 4.1.2 allows remote attackers to cause a denial of service (crash) or possibly… Affected: through 4.1.1 |
| CVE-2014-3575 | – | Aug 27 | The OLE preview generation in Apache OpenOffice before 4.1.1 and OpenOffice.org (OOo) might allow remote attackers to embed arbitrary data into documents via crafted OLE objects Affected: before 4.1.1 |
| CVE-2014-3524 | – | Aug 26 | Apache OpenOffice before 4.1.1 allows remote attackers to execute arbitrary commands and possibly have other unspecified impact via a crafted Calc spreadsheet Affected: before 4.1.1 |
| CVE-2013-4156 | – | Jul 31 | Apache OpenOffice.org (OOo) before 4.0 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted element in… Affected: before 4.0.0 |
| CVE-2013-2189 | – | Jul 31 | Apache OpenOffice.org (OOo) before 4.0 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via invalid PLCF data in… Affected: before 4.0.0 |
| CVE-2012-2665 | – | Aug 6 | Multiple heap-based buffer overflows in the XML manifest encryption tag parsing functionality in OpenOffice.org and LibreOffice before 3.5.5 allow remote attackers to cause a… Affected: before 3.4.1 |
| CVE-2010-3452 | – | Jan 28 | Use-after-free vulnerability in oowriter in OpenOffice.org (OOo) 2.x and 3.x before 3.3 allows remote attackers to cause a denial of service (application crash) or possibly… Affected: 2.0.0 before 3.3.0 |
| CVE-2010-3451 | – | Jan 28 | Use-after-free vulnerability in oowriter in OpenOffice.org (OOo) 2.x and 3.x before 3.3 allows remote attackers to cause a denial of service (application crash) or possibly… Affected: 2.0.0 before 3.3.0 |
| CVE-2010-3450 | – | Jan 28 | Multiple directory traversal vulnerabilities in OpenOffice.org (OOo) 2.x and 3.x before 3.3 allow remote attackers to overwrite arbitrary files via a Affected: 2.0.0 before 3.3.0 |
| CVE-2010-4253 | – | Jan 28 | Heap-based buffer overflow in Impress in OpenOffice.org (OOo) 2.x and 3.x before 3.3 allows remote attackers to cause a denial of service (application crash) or possibly execute… Affected: 2.0.0 before 3.3.0 |
| CVE-2010-4643 | – | Jan 28 | Heap-based buffer overflow in Impress in OpenOffice.org (OOo) 2.x and 3.x before 3.3 allows remote attackers to cause a denial of service (application crash) or possibly execute… Affected: 2.0.0 before 3.3.0 |
| CVE-2010-3689 | – | Jan 28 | soffice in OpenOffice.org (OOo) 3.x before 3.3 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared… Affected: 3.0.0 before 3.3.0 |
| CVE-2010-3454 | – | Jan 28 | Multiple off-by-one errors in the WW8DopTypography::ReadFromMem function in oowriter in OpenOffice.org (OOo) 2.x and 3.x before 3.3 allow remote attackers to cause a denial of… Affected: 2.0.0 before 3.3.0 |