CVE-2023-2255
Description
Improper access control in editor components of The Document Foundation LibreOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt. In the affected versions of LibreOffice documents that used "floating frames" linked to external files, would load the contents of those frames without prompting the user for permission to do so. This was inconsistent with the treatment of other linked content in LibreOffice. This issue affects: The Document Foundation LibreOffice 7.4 versions prior to 7.4.7; 7.5 versions prior to 7.5.3.
How to fix
- libreoffice libreoffice7.4.7, 7.5.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| libreoffice libreoffice | 7.4.0 ≤ v < 7.4.7, 7.5.0 ≤ v < 7.5.3 | 7.4.7, 7.5.3 |
| debian debian_linux | 11.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.