LibreOffice URI Scheme Vulnerability Enables Arbitrary Macro Execution
A vulnerability exists in LibreOffice related to Office URI Schemes and browser integration with MS SharePoint server. The issue involves the 'vnd.libreoffice.command' scheme specific to LibreOffice. An attacker could craft a malicious link in a browser using this scheme that contains an embedded inner URL. When passed to LibreOffice, this link could potentially trigger internal macros with arbitrary arguments. The vulnerability impacts LibreOffice versions from 24.8 before 24.8.5 and from 25.2 before 25.2.1. Users of these specific LibreOffice versions should update to the latest patched release to mitigate this security risk.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
the document foundation libreoffice |
Vulmon