Critical Security Update for LibreOffice: DSA-5846-1
Summary
DSA-5846-1: libreoffice - security update. Affects libreoffice versions < 4:7.4.7-1+deb12u6. Fixed in 4:7.4.7-1+deb12u6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
LibreOffice is a powerful open-source office suite that provides a range of applications for word processing, spreadsheets, presentations, and more. It is widely used across various platforms and is known for its compatibility with multiple document formats. However, like any software, it is susceptible to vulnerabilities that can compromise user data and system integrity. The recent security update addresses critical vulnerabilities that could potentially allow unauthorized access or manipulation of documents.
Vulnerability Detail
The vulnerabilities identified in LibreOffice, specifically CVE-2024-12425 and CVE-2024-12426, stem from flaws in the handling of certain document types. These vulnerabilities could allow an attacker to execute arbitrary code or access sensitive information by crafting malicious documents. The potential ramifications include data breaches, unauthorized access to user files, and system compromise, making it imperative for users to apply the necessary updates promptly.
How To Fix
Minimum fixed version
4:7.4.7-1+deb12u6
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libreofficeTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users are advised to avoid opening untrusted documents or files from unknown sources until the update is applied. This can help mitigate the risk of exploitation through the identified vulnerabilities.
Conclusion
The recent security update for LibreOffice addresses critical vulnerabilities that could pose significant risks to users. It is essential to update to the latest version to ensure the security and integrity of your documents. By following the outlined steps, users can protect themselves from potential threats.
See every vulnerability recorded for libreoffice →
FAQ
The update addresses CVE-2024-12425 and CVE-2024-12426, which are critical vulnerabilities in LibreOffice that could allow unauthorized access or code execution.
You can check your version of LibreOffice by opening the application and navigating to 'Help' > 'About LibreOffice'. Compare your version with the patched version 4:7.4.7-1+deb12u6.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json. You can check if your application is affected by visiting the Vulert playground at Vulert Scanner.
If you cannot update immediately, avoid opening documents from untrusted sources to reduce the risk of exploitation until you can apply the update.
More information can be found in the Debian security advisory DSA-5846-1, which details the vulnerabilities and the steps for remediation.
Related vulnerabilities
Recent vulnerabilities recorded for libreoffice.
