LI
Product
Libreoffice
71
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 13High 26Medium 15Low 1
Watch
Add Libreoffice to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-5261 | 9.8 | Jun 25 | Improper Certificate Validation vulnerability in LibreOffice "LibreOfficeKit" mode disables TLS certification verification LibreOfficeKit can be used for accessing LibreOffice… Affected: before 24.2.4 |
| CVE-2019-9855 | 9.8 | Sep 6 | LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is… Affected: 6.2.0 before 6.2.7; 6.3.0 before 6.3.1 |
| CVE-2019-9851 | 9.8 | Aug 15 | LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is… Affected: before 6.2.6 |
| CVE-2019-9850 | 9.8 | Aug 15 | LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is… Affected: before 6.2.6 |
| CVE-2019-9848 | 9.8 | Jul 17 | LibreOffice has a feature where documents can specify that pre-installed scripts can be executed on various document events such as mouse-over, etc Affected: before 6.2.5 |
| CVE-2018-16858 | 9.8 | Mar 25 | It was found that libreoffice before versions 6.0.7 and 6.1.3 was vulnerable to a directory traversal attack which could be used to execute arbitrary macros bundled with a… Affected: before 6.0.7; 6.1.0 before 6.1.3 |
| CVE-2018-14939 | 9.8 | Aug 5 | The get_app_path function in desktop/unx/source/start.c in LibreOffice through 6.0.5 mishandles the realpath function in certain environments such as FreeBSD libc, which might… Affected: through 6.0.5 |
| CVE-2018-6871 | 9.8 | Feb 9 | LibreOffice before 5.4.5 and 6.x before 6.0.1 allows remote attackers to read arbitrary files via =WEBSERVICE calls in a document, which use the COM.MICROSOFT.WEBSERVICE function Affected: before 5.4.5; 6.0.0; 6.0.0; 6.0.0; 6.0.0 |
| CVE-2017-8358 | 9.8 | Apr 30 | LibreOffice before 2017-03-17 has an out-of-bounds write caused by a heap-based buffer overflow related to the ReadJPEG function in vcl/source/filter/jpeg/jpegc.cxx Affected: through 5.2.6 |
| CVE-2017-7882 | 9.8 | Apr 15 | LibreOffice before 2017-03-14 has an out-of-bounds write related to the HWPFile::TagsRead function in hwpfilter/source/hwpfile.cxx Affected: through 5.2.6 |
| CVE-2017-7870 | 9.8 | Apr 14 | LibreOffice before 2017-01-02 has an out-of-bounds write caused by a heap-based buffer overflow related to the tools::Polygon::Insert function in tools/source/generic/poly.cxx Affected: through 5.3.0.0 |
| CVE-2017-7856 | 9.8 | Apr 14 | LibreOffice before 2017-03-11 has an out-of-bounds write caused by a heap-based buffer overflow in the SVMConverter::ImplConvertFromSVM1 function in… Affected: through 5.2.6.1 |
| CVE-2016-10327 | 9.8 | Apr 14 | LibreOffice before 2016-12-22 has an out-of-bounds write caused by a heap-based buffer overflow related to the EnhWMFReader::ReadEnhWMF function in… Affected: through 5.3.0.0 |
| CVE-2023-6186 | 8.8 | Dec 11 | Insufficient macro permission validation of The Document Foundation LibreOffice allows an attacker to execute built-in macros without warning Affected: 7.5.0 before 7.5.9; 7.6.0 before 7.6.4 |
| CVE-2023-6185 | 8.8 | Dec 11 | Improper Input Validation vulnerability in GStreamer integration of The Document Foundation LibreOffice allows an attacker to execute arbitrary GStreamer plugins Affected: 7.5.0 before 7.5.9; 7.6.0 before 7.6.3 |
| CVE-2022-26307 | 8.8 | Jul 25 | LibreOffice supports the storage of passwords for web connections in the user’s configuration database Affected: 7.2.0 before 7.2.7; 7.3.0 before 7.3.3 |
| CVE-2021-25631 | 8.8 | May 3 | In the LibreOffice 7-1 series in versions prior to 7.1.2, and in the 7-0 series in versions prior to 7.0.5, the denylist can be circumvented by manipulating the link so it doesn't… Affected: 7.0.0 before 7.0.5; 7.1.0 before 7.1.2 |
| CVE-2026-4430 | 7.8 | May 7 | Heap Buffer Overflow in AgileEngine Affected: 25.8.0.0 before 25.8.7.0; 26.2.0.0 before 26.2.3.0 |
| CVE-2025-1080 | 7.8 | Mar 4 | LibreOffice supports Office URI Schemes to enable browser integration of LibreOffice with MS SharePoint server Affected: 24.8.0.0 before 24.8.5.1; 25.2.0.0 before 25.2.1.1 |
| CVE-2025-0514 | 7.8 | Feb 25 | Improper Input Validation vulnerability in The Document Foundation LibreOffice allows Windows Executable hyperlink targets to be executed unconditionally on activation.This issue… Affected: 24.8.0.0 before 24.8.5.1 |
| CVE-2024-7788 | 7.8 | Sep 17 | Improper Digital Signature Invalidation vulnerability in Zip Repair Mode of The Document Foundation LibreOffice allows Signature forgery vulnerability in LibreOfficeThis issue… Affected: 24.2.0 before 24.2.5 |
| CVE-2024-6472 | 7.8 | Aug 5 | Certificate Validation user interface in LibreOffice allows potential vulnerability Affected: 24.2.0.0 before 24.2.5.1 |
| CVE-2023-0950 | 7.8 | May 25 | Improper Validation of Array Index vulnerability in the spreadsheet component of The Document Foundation LibreOffice allows an attacker to craft a spreadsheet document that will… Affected: 7.4.0 before 7.4.6; 7.5.0 before 7.5.2 |
| CVE-2019-9853 | 7.8 | Sep 27 | LibreOffice documents can contain macros Affected: 6.2.0 before 6.2.6; 6.3.0 before 6.3.1 |
| CVE-2019-9854 | 7.8 | Sep 6 | LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document-open etc Affected: 6.2.0 before 6.2.7; 6.3.0 before 6.3.1 |
| CVE-2019-9852 | 7.8 | Aug 15 | LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document-open etc Affected: before 6.2.6 |
| CVE-2019-9847 | 7.8 | May 9 | A vulnerability in LibreOffice hyperlink processing allows an attacker to construct documents containing hyperlinks pointing to the location of an executable on the target users… Affected: before 6.1.6; 6.2 before 6.2.3 |
| CVE-2018-10120 | 7.8 | Apr 16 | The SwCTBWrapper::Read function in sw/source/filter/ww8/ww8toolbar.cxx in LibreOffice before 5.4.6.1 and 6.x before 6.0.2.1 does not validate a customizations index, which allows… Affected: before 5.4.6.1; 6.0.0 before 6.0.2.1 |
| CVE-2018-10119 | 7.8 | Apr 16 | sot/source/sdstor/stgstrms.cxx in LibreOffice before 5.4.5.1 and 6.x before 6.0.1.1 uses an incorrect integer data type in the StgSmallStrm class, which allows remote attackers to… Affected: before 5.4.5.1; 6.0.0 before 6.0.1.1 |
| CVE-2016-4324 | 7.8 | Jul 8 | Use-after-free vulnerability in LibreOffice before 5.1.4 allows remote attackers to execute arbitrary code via a crafted RTF file, related to stylesheet and superscript tokens Affected: through 5.1.3 |
| CVE-2016-0795 | 7.8 | Feb 18 | LibreOffice before 5.0.5 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted LwpTocSuperLayout record… Affected: through 5.0.4 |
| CVE-2016-0794 | 7.8 | Feb 18 | The lwp filter in LibreOffice before 5.0.4 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted… Affected: through 5.0.3 |
| CVE-2022-26306 | 7.5 | Jul 25 | LibreOffice supports the storage of passwords for web connections in the user’s configuration database Affected: 7.2.0 before 7.2.7; 7.3.0 before 7.3.3 |
| CVE-2022-26305 | 7.5 | Jul 25 | An Improper Certificate Validation vulnerability in LibreOffice existed where determining if a macro was signed by a trusted author was done by only matching the serial number and… Affected: 7.2.0 before 7.2.7; 7.3.0 before 7.3.2 |
| CVE-2021-25636 | 7.5 | Feb 24 | LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurred since the last signing and… Affected: 7.2.0 before 7.2.5 |
| CVE-2021-25634 | 7.5 | Oct 12 | LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurred since the last signing and… Affected: 7.0.0 before 7.0.6; 7.1.0 before 7.1.2 |
| CVE-2021-25633 | 7.5 | Oct 11 | LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurred since the last signing and… Affected: 7.0.0 before 7.0.6; 7.1.0 before 7.1.2 |
| CVE-2018-10583 | 7.5 | May 1 | An information disclosure vulnerability occurs when LibreOffice 6.0.3 and Apache OpenOffice Writer 4.1.5 automatically process and initiate an SMB connection embedded in a… Affected: 6.0.3 |
| CVE-2017-14226 | 7.5 | Sep 9 | WP1StylesListener.cpp, WP5StylesListener.cpp, and WP42StylesListener.cpp in libwpd 0.10.1 mishandle iterators, which allows remote attackers to cause a denial of service… Affected: through 5.3.6 |
| CVE-2025-14714 | 6.5 | Dec 15 | An Authentication Bypass vulnerability existed where the application bundled an interpreter (Python) that inherits the Transparency, Consent, and Control (TCC) permissions granted… Affected: 25.2.0.1 before 25.2.4.1 |
| CVE-2024-12426 | 6.5 | Jan 7 | URL fetching can be used to exfiltrate arbitrary INI file values and environment variables Affected: 24.8.0.1 before 24.8.4; 24.8.0.0; 24.8.0.0 |
| CVE-2024-3044 | 6.5 | May 14 | Unchecked script execution in Graphic on-click binding in affected LibreOffice versions allows an attacker to create a document which without prompt will execute scripts… Affected: before 7.6.7.1; 24.2.0.0 before 24.2.3.1 |
| CVE-2020-12803 | 6.5 | Jun 8 | ODF documents can contain forms to be filled out by the user Affected: before 6.4.4 |
| CVE-2012-5639 | 6.5 | Dec 20 | LibreOffice and OpenOffice automatically open embedded content Affected: All versions, or not specified |
| CVE-2012-0037 | 6.5 | Jun 17 | Redland Raptor (aka libraptor) before 2.0.7, as used by OpenOffice 3.3 and 3.4 Beta, LibreOffice before 3.4.6 and 3.5.x before 3.5.1, and other products, allows user-assisted… Affected: before 3.4.6; 3.5.0 |
| CVE-2022-3140 | 6.3 | Oct 11 | Macro URL arbitrary script execution Affected: 7.3.0 before 7.3.6; 7.4.0 |
| CVE-2025-2866 | 5.5 | Apr 27 | Improper Verification of Cryptographic Signature vulnerability in LibreOffice allows PDF Signature Spoofing by Improper Validation Affected: 24.8.0.1 before 24.8.6.0; 25.2.0.1 before 25.2.2; 24.8.0.0; 24.8.0.0; 25.2.0.0; 25.2.0.0 |
| CVE-2021-25635 | 5.5 | Mar 21 | An Improper Certificate Validation vulnerability in LibreOffice allowed an attacker to self sign an ODF document, with a signature untrusted by the target, then modify it to… Affected: 7.0.0 before 7.0.5.1; 7.1.0.0 through 7.1.1.1 |
| CVE-2023-1183 | 5.5 | Jul 10 | A flaw was found in the Libreoffice package Affected: before 7.4.6; 7.5.0 |
| CVE-2023-2255 | 5.3 | May 25 | Improper access control in editor components of The Document Foundation LibreOffice allowed an attacker to craft a document that would cause external links to be loaded without… Affected: 7.4.0 before 7.4.7; 7.5.0 before 7.5.3 |