CVE-2018-10583

CVE-2018-10583 An information disclosure vulnerability occurs when LibreOffice 6.0.3 and Apache OpenOffice Writer 4.1.5 automatically process and initiate an SMB connection embedded in a malicious file, as demonstrated by "xlink:href=file://192.168.0.2/test.jpg" within an "office:document-content...

CVE-2020-27603-bbb-libreoffice-poc

CVE-2020-27603-bbb-libreoffice-poc Proof of Concept of Libreoffice file exfiltration vulnerability in Big Blue Button These ODT files show how to exploit a file exfiltration vulnerability that can happen with server-side Libreoffice rendering, e.g. BigBlueButton. Background:...

CVE-2023-36664

CVE-2023-36664 : Ghostscript remote code execution Proof of concept for the CVE-2023-36664. Usage To insert a payload into a .eps file : python3 poc.py -f "filename" --payload "command" python3 poc.py -f file.eps --payload firefox To insert a reverse shell payload into a .eps file : python3 poc.p...

CVE-2023-2255

Command to execute the creation of the exploit: sudo python3 starkelevate.py /home/bob/Downloads/librecommand.exe --output librecommand.odt educational purposes only...

libreofficeExploit1

Basic exploit generation manual This post will cover how to use a simple program flaw to open a backdoor in the system that runs that program. The flaw in question is defined in CVE-2018-16858 belonging to the LibreOffice office suite. This flaw, in a specially crafted file, achieves directory...

Windows-Exploit-Suggester-Python3

Windows-Exploit-Suggester-Python3 python3 windows-exploit-suggester.py --update libreoffice --headless --convert-to xls 2021-07-15-mssb.xlsx python3 windows-exploit-suggester.py --database 2021-07-15-mssb.xls --systeminfo systeminfo.txt Example : so we should convert xlsx to xls...

libreoffice-remote-arbitrary-file-disclosure

Vulnerability description CVE-2018-6871 First part LibreOffice supports COM.MICROSOFT.WEBSERVICE function: https://support.office.com/en-us/article/webservice-function-0546a35a-ecc6-4739-aed7-c0b7ce1562c4 The function is required to obtain data by URL, usually used as:...

Gotenberg < 8.34.0 - Local File Disclosure

Gotenberg before 8.34.0 allows SSRF and limited local file disclosure via its /forms/libreoffice/convert endpoint. When LibreOffice is used to convert user-uploaded DOCX files, external relationships within the document such as a:blip r:link TargetMode="External" can instruct LibreOffice to fetch...

HTB-Mailing-A-Complete-Walkthrough

HTB: Mailing — A Complete Walkthrough By Mursalin If you've been grinding through HackTheBox machines, Mailing is one of those boxes that genuinely teaches you something. It's rated Easy, runs on Windows, and chains together a few real-world vulnerabilities — a directory traversal, a credential...

CVE-2018-10583

Updated python3 exploit for CVE-2018-10583 LibreOffice/Open Office - '.odt' Information Disclosure original credits to : https://www.exploit-db.com/exploits/44564 Usage 1. Install ezodf module with pip or pip3 2. Run the exploit with python3 it will generate a bad.odt file, upload it to the box 3...

CVE-2019-9849

CVE-2019-9849: Remote bullet graphics retrieved in “stealth mode” in LibreOffice LibreOffice has a 'stealth mode' in which only documents from locations deemed 'trusted' are allowed to retrieve remote resources. This mode is not the default mode, but can be enabled by users who want to disable...

Rocky Linux 8 [CIQ] Security Update: autocorr-af / autocorr-bg / autocorr-ca / autocorr-cs / autocorr-da / etc Multiple Vulnerabilities (crlsa-2026_88164)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202688164 advisory. libreoffice: heap buffer overflow in PDF import stream handling CVE-2026-63274 libreoffice: stack buffer overflow in CFF to Type 1 font conversion...

RLSA-2026:88164 Important: flute, libbase, libfonts, libformula, liblayout, libloader, libreoffice, librepository, libserializer, pentaho-libxml, pentaho-reporting-flow-engine, and sac security, bug fix, and enhancement update

SAC is a standard interface for CSS parsers, intended to work with CSS1, CSS2, CSS3 and other CSS derived languages. Security Fixes: libreoffice: heap buffer overflow in PDF import stream handling CVE-2026-63274 libreoffice: stack buffer overflow in CFF to Type 1 font conversion CVE-2026-63276...

flute, libbase, libfonts, libformula, liblayout, libloader, libreoffice, librepository, libserializer, pentaho-libxml, pentaho-reporting-flow-engine, and sac security, bug fix, and enhancement update

An update is available for pentaho-reporting-flow-engine, pentaho-libxml, liblayout, libfonts, libformula, librepository, libserializer, libreoffice, libbase, flute, libloader. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severit...

RockyLinux 8 : flute, libbase, libfonts, libformula, liblayout, libloader, libreoffice, librepository, libserializer, pentaho-libxml, pentaho-reporting-flow-engine, and sac (RLSA-2026:88164)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:88164 advisory. libreoffice: heap buffer overflow in PDF import stream handling CVE-2026-63274 libreoffice: stack buffer overflow in CFF to Type 1 font conversion...

libreoffice: stack buffer overflow in CFF to Type 1 font conversion

A flaw was found in LibreOffice. When a user exports a document with crafted embedded fonts to PDF, a stack-based buffer overflow can occur during the conversion of CFF fonts to Type 1 fonts due to improper bounds checking. This issue can cause memory corruption, resulting in an application crash...

libreoffice: libreoffice: Arbitrary code execution via remote Java database driver

A flaw was found in LibreOffice. When linking spreadsheet cell ranges to external data sources in Calc, a document can specify an external Java database driver. By convincing a user to open a specially crafted document, a remote attacker can force the application to download and execute untrusted...

Important: Red Hat Security Advisory: flute, libbase, libfonts, libformula, liblayout, libloader, libreoffice, librepository, libserializer, pentaho-libxml, pentaho-reporting-flow-engine, and sac security, bug fix, and enhancement update

An update for multiple packages is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

libreoffice: heap buffer overflow in PDF import stream handling

A flaw was found in LibreOffice. When a user imports a specially crafted PDF document with LibreOffice Draw, a heap-based buffer overflow can occur due to improper validation of the stream length. This issue can cause memory corruption, resulting in an application crash...

libreoffice: stack buffer overflow in CFF font hint handling

A flaw was found in LibreOffice. When a user opens a specially crafted document containing embedded CFF fonts, a stack-based buffer overflow can occur when reading the hints of a glyph due to improper bounds checking. This issue can cause memory corruption, resulting in an application crash...