LibreOffice 24.8.x < 24.8.4 Multiple vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(214314);
  script_version("1.6");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/12/10");

  script_cve_id("CVE-2024-12425", "CVE-2024-12426");
  script_xref(name:"IAVB", value:"2025-B-0003-S");

  script_name(english:"LibreOffice 24.8.x < 24.8.4 Multiple vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"The version of LibreOffice installed on the remote host is prior to 24.8.4. It is, therefore, affected by multiple
vulnerabilities as referenced in the advisory.

  - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The Document 
    Foundation LibreOffice allows Absolute Path Traversal. An attacker can write to arbitrary locations, albeit 
    suffixed with '.ttf', by supplying a file in a format that supports embedded font files. (CVE-2024-12425)

  - Exposure of Environmental Variables and arbitrary INI file values to an Unauthorized Actor vulnerability in 
    The Document Foundation LibreOffice. URLs could be constructed which expanded environmental variables or INI 
    file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document 
    containing such links. (CVE-2024-12426)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://www.libreoffice.org/about-us/security/advisories/CVE-2024-12425/
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?186d87e8");
  # https://www.libreoffice.org/about-us/security/advisories/CVE-2024-12426/
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?2c820250");
  script_set_attribute(attribute:"solution", value:
"Upgrade to LibreOffice version 24.8.4 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-12426");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/01/07");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/01/07");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/01/17");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:libreoffice:libreoffice");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("libreoffice_installed.nasl", "macosx_libreoffice_installed.nasl");
  script_require_keys("installed_sw/LibreOffice");

  exit(0);
}

include('vcf.inc');

var app_info = vcf::get_app_info(app:'LibreOffice');

var constraints = [
  { 'min_version' : '24.8.0', 'fixed_version' : '24.8.4' }
];

vcf::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_HOLE
);