CVE-2024-3044

Unchecked script execution in Graphic on-click binding in affected LibreOffice versions allows an attacker to create a document which without prompt will execute scripts built-into LibreOffice on clicking a graphic. Such scripts were previously deemed trusted but are now deemed untrusted.

Unchecked script execution in Graphic on-click binding in affected LibreOffice versions allows an attacker to create a document which without prompt will execute scripts built-into LibreOffice on clicking a graphic. Such scripts were previously deemed trusted but are now deemed untrusted.

LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a drawing program. LibreOffice replaces OpenOffice and provides a similar but enhanced and extended office suite.

Security Fix(es):

• libreoffice: create a document which without prompt will execute scripts built-into LibreOffice on clicking a graphic (CVE-2024-3044)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Unchecked script execution in Graphic on-click binding in affected LibreOffice versions allows an attacker to create a document which without prompt will execute scripts built-into LibreOffice on clicking a graphic. Such scripts were previously deemed trusted but are now deemed untrusted.

LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a drawing program. LibreOffice replaces OpenOffice and provides a similar but enhanced and extended office suite.

Security Fix(es):

• libreoffice: create a document which without prompt will execute scripts built-into LibreOffice on clicking a graphic (CVE-2024-3044)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a drawing program. LibreOffice replaces OpenOffice and provides a similar but enhanced and extended office suite.

Security Fix(es):

• libreoffice: create a document which without prompt will execute scripts built-into LibreOffice on clicking a graphic (CVE-2024-3044)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• CVE-2022-38745: avoid unnecessary empty -Djava.class.path=
• CVE-2024-3044: add notify for script execution

Unchecked script execution in Graphic on-click binding in affected LibreOffice versions allows an attacker to create a document which without prompt will execute scripts built-into LibreOffice on clicking a graphic. Such scripts were previously deemed trusted but are now deemed untrusted. (CVE-2024-3044)

This update for libreoffice fixes the following issues:

Libreoffice was updated to version 24.2.4.2:

• Release notes:

  • https://wiki.documentfoundation.org/Releases/24.2.1/RC1
  • https://wiki.documentfoundation.org/Releases/24.2.1/RC2

• Security issues fixed:

  • CVE-2024-3044: Fixed unchecked script execution in graphic on-click binding (bsc#1224279)

• Other issues fixed:

  • Fixed LibreOffice build failures with ICU 75 (bsc#1224309)

• Updated bundled dependencies:

  • curl version update from 8.6.0 to 8.7.1
  • gpgme version update from 1.20.0 to 1.23.2
  • libassuan version update from 2.5.6 to 2.5.7
  • libgpg-error version update from 1.47 to 1.48

This update for libreoffice fixes the following issues:

Libreoffice was updated to version 24.2.4.2:

• Release notes:

  • https://wiki.documentfoundation.org/Releases/24.2.1/RC1
  • https://wiki.documentfoundation.org/Releases/24.2.1/RC2

• Security issues fixed:

  • CVE-2024-3044: Fixed unchecked script execution in graphic on-click binding (bsc#1224279)

• Other issues fixed:

  • Fixed LibreOffice build failures with ICU 75 (bsc#1224309)

• Updated bundled dependencies:

  • curl version update from 8.6.0 to 8.7.1
  • gpgme version update from 1.20.0 to 1.23.2
  • libassuan version update from 2.5.6 to 2.5.7
  • libgpg-error version update from 1.47 to 1.48

Amel Bouziane-Leblond discovered that LibreOffice incorrectly handled graphic on-click bindings. If a user were tricked into clicking a graphic in a specially crafted document, a remote attacker could possibly run arbitrary script.