CVE-2023-47804: Apache OpenOffice: Macro URL arbitrary script execution
Description In Apache OpenOffice and LibreOffice embedded content will be opened automatically without that a warning is shown. Severity: Moderate There are no known exploits of this vulnerability. A proof-of-concept demonstration exists. Thanks to the reporter for discovering this issue. Vendor: The Apache Software Foundation Versions Affected All Apache OpenOffice versions 4.1.14 and older are affected. OpenOffice.org versions may also be affected. Mitigation Install Apache OpenOffice 4.1.15 for the latest maintenance and cumulative security fixes. Use the Apache OpenOffice download page. Acknowledgments The Apache OpenOffice Security Team would like to thank Timo Warns and Joachim Mammele for discovering and reporting this attack vector.References: References: https://www.cve.org/CVERecord?id=CVE-2023-47804 https://www.openoffice.org/security/cves/CVE-2023-47804.html https://openoffice.apache.org/
CVE-2023-47804: Apache OpenOffice: Macro URL arbitrary script execution
Severity: important Affected versions: - Apache OpenOffice through 4.1.15 Description: Apache OpenOffice documents can contain links that call internal macros with arbitrary arguments. Several URI Schemes are defined for this purpose. Links can be activated by clicks, or by automatic document events. The execution of such links must be subject to user approval. In the affected versions of OpenOffice, approval for certain links is not requested; when activated, such links could therefore result in arbitrary script execution. This is a corner case of CVE-2022-47502. Credit: Amel BOUZIANE-LEBLOND aka Icare Bug Bounty Hunter (reporter) References: https://openoffice.apache.org/ https://www.cve.org/CVERecord?id=CVE-2023-47804
