#LibreOffice: patches two #vulnerabilities allowing arbitrary file writes & remote data extraction from environment variables & configuration files. CVE-2024-12425 & CVE-2024-12426 require no user interaction beyond opening a malicious document containing a malicious font or an image:
👇
https://securityonline.info/libreoffice-vulnerabilities-cve-2024-12425-cve-2024-12426-pocs-released-patch-asap/
Sam Stepanyan :verified: 🐘
npub1gr…9gp67
2025-02-18 09:04:31 UTC
Author Public Key
npub1gr8f0c2al23r8wpv2v7vt2na36g3xnpz06pceqhrysmlg8gahyjqp9gp67Seen on
wss://relay.momostr.pinkPublished at
2025-02-18 09:04:31 UTCEvent JSON
{
"id": "aa7029ef5d1620d703b9f9625c72a2466d389920c8603852560c6e2d591711b3",
"pubkey": "40ce97e15dfaa233b82c533cc5aa7d8e91134c227e838c82e32437f41d1db924",
"created_at": 1739869471,
"kind": 1,
"tags": [
[
"proxy",
"https://infosec.exchange/@securestep9/114024085695036829",
"web"
],
[
"t",
"libreoffice"
],
[
"t",
"vulnerabilities"
],
[
"proxy",
"https://infosec.exchange/users/securestep9/statuses/114024085695036829",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://infosec.exchange/users/securestep9/statuses/114024085695036829",
"pink.momostr"
],
[
"-"
]
],
"content": "#LibreOffice: patches two #vulnerabilities allowing arbitrary file writes \u0026 remote data extraction from environment variables \u0026 configuration files. CVE-2024-12425 \u0026 CVE-2024-12426 require no user interaction beyond opening a malicious document containing a malicious font or an image:\n👇\nhttps://securityonline.info/libreoffice-vulnerabilities-cve-2024-12425-cve-2024-12426-pocs-released-patch-asap/",
"sig": "4cf304f2ece6406cdfd4050ba18cc63f4d7880208573bbacb9218247538e13828ef8ad17b46399f88e3bd9a09ac729c52ec07848e648d29d6fa3fa152bcdc4d9"
}