CVE-2022-37400

CVE-2022-37400 affects Apache OpenOffice and LibreOffice: a flaw where the initialization vector for encrypting stored web-connection passwords is always the same, weakening encryption if an attacker gains access to the user’s configuration data. The issue impacts Apache OpenOffice

CVE-2021-30245

CVE-2021-30245 affects Apache OpenOffice up to version 4.1.9 (and 4.1.8); the issue arises from handling non-http(s) hyperlinks, where a specially crafted link could lead to untrusted code execution when a user opens a document. The root cause is related to hyperlink handling that accepts non-htt...

CVE-2022-37401

CVE-2022-37401 describes weak master-key encoding in OpenOffice/OpenOffice-derived LibreOffice implementations that protects web-connection passwords in the user configuration database. The root cause is poor encoding of the master key, dropping entropy from 128 bits to 43 bits, which enables bru...

CVE-2023-47804

CVE-2023-47804 affects Apache OpenOffice prior to 4.1.15. It stems from links in documents that call internal macros with arbitrary arguments; in affected versions, user approval for such links isn’t always requested, enabling arbitrary script execution when links are clicked or triggered by docu...

CVE-2025-64403

CVE-2025-64403 affects Apache OpenOffice up to version 4.1.15 (Calc external data sources and other external links). Root cause is missing authorization checks that allow an attacker to craft a document to load links without prompting the user. A fix is available in OpenOffice 4.1.16. Other relat...