LibreOffice < 26.2.5 Multiple Vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(350094);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/25");

  script_cve_id(
    "CVE-2026-63272",
    "CVE-2026-63273",
    "CVE-2026-63274",
    "CVE-2026-63275",
    "CVE-2026-63276",
    "CVE-2026-63278",
    "CVE-2026-63279"
  );
  script_xref(name:"IAVB", value:"2026-B-0272");

  script_name(english:"LibreOffice < 26.2.5 Multiple Vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"An application installed on the remote host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of LibreOffice installed on the remote host is prior to 26.2.5. It is, therefore, affected by multiple
vulnerabilities:

  - LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing an encrypted
    document. The length of the decryption key was taken from the document's own encryption dictionary and was
    used to fill a fixed size key buffer without being checked against it, so a length larger than that buffer
    wrote past its end. (CVE-2026-63273)

  - LibreOffice converts CFF fonts to Type 1 when it subsets a font, which happens when a document is exported
    to PDF, and CFF fonts may be embedded in documents. A stack buffer overflow existed in that conversion. The
    converted operators were written into a fixed size buffer with no check that they still fit, so a glyph
    emitting many operators wrote past the end of the buffer. (CVE-2026-63276)

  - LibreOffice can import WMF graphics, which may be embedded in documents. A heap buffer overflow existed when
    importing a text record that carries its own character advance widths. The count of advance values and the
    length of the text were read separately from the file and were not required to agree, so drawing the text
    walked the advance array by character position and ran past its end when the array was the shorter of the
    two. (CVE-2026-63272)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://www.libreoffice.org/about-us/security/advisories/cve-2026-63272
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?9a765d3e");
  # https://www.libreoffice.org/about-us/security/advisories/cve-2026-63273
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?b2fa10ea");
  # https://www.libreoffice.org/about-us/security/advisories/cve-2026-63274
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?964787b0");
  # https://www.libreoffice.org/about-us/security/advisories/cve-2026-63275
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?5e643907");
  # https://www.libreoffice.org/about-us/security/advisories/cve-2026-63276
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?f5f02d37");
  # https://www.libreoffice.org/about-us/security/advisories/cve-2026-63278
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?f0734e97");
  # https://www.libreoffice.org/about-us/security/advisories/cve-2026-63279
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?ef34ee40");
  script_set_attribute(attribute:"solution", value:
"Upgrade to LibreOffice version 26.2.5 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-63273");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/21");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/21");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/25");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:libreoffice:libreoffice");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("libreoffice_installed.nasl", "macosx_libreoffice_installed.nasl");
  script_require_keys("installed_sw/LibreOffice");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'LibreOffice', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {'fixed_version': '26.2.5'}
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:result);