K0R0L

**Name of the Vulnerable Software and Affected Versions** ONLYOFFICE DocumentServer versions 4.0.3 through 7.3.2 **Description** A use after free issue in ONLYOFFICE DocumentServer allows remote attackers to run arbitrary code via a crafted JavaScript file. This issue is related to the JavaScript File Handler component and can be exploited by running a specially formed JavaScript file, enabling the attacker to execute arbitrary code. **Recommendations** For versions 4.0.3 through 7.3.2, consider disabling the JavaScript File Handler component as a temporary workaround until a patch is available. Restrict access to the vulnerable component to minimize the risk of exploitation. Avoid using crafted JavaScript files in the affected versions until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ONLYOFFICE Document Server versions 4.0.3 through 7.3.2 **Description** The issue is related to a Memory Exhaustion vulnerability in the JavaScript File Handler component of ONLYOFFICE Document Server. This vulnerability allows remote attackers to cause a denial of service via a crafted JavaScript file. The exploitation of this vulnerability is associated with incorrect cleanup or release of resources. **Recommendations** For versions 4.0.3 through 7.3.2, consider disabling the JavaScript File Handler component as a temporary workaround to minimize the risk of exploitation until a patch is available. Restrict access to crafted JavaScript files to prevent remote attackers from causing a denial of service. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ONLYOFFICE DocumentServer versions 4.0.3 through 7.3.2 **Description** An out of bounds memory access issue in the JavaScript File Handler component allows remote attackers to execute arbitrary code via a crafted JavaScript file. This can be exploited by running a specially formed JavaScript file, potentially leading to code execution. **Recommendations** For versions 4.0.3 through 7.3.2, consider disabling the JavaScript File Handler component as a temporary workaround until a patch is available. Restrict access to the vulnerable component to minimize the risk of exploitation. Avoid using crafted JavaScript files in the affected versions until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Onlyoffice Document Server versions 6.0.0 and below Onlyoffice Core versions 6.1.0.26 and below **Description** A stack overflow issue was discovered in the DesktopEditor/common/File.cpp component. **Recommendations** For Onlyoffice Document Server versions 6.0.0 and below, update to a version above 6.0.0. For Onlyoffice Core versions 6.1.0.26 and below, update to a version above 6.1.0.26.

**Name of the Vulnerable Software and Affected Versions** Onlyoffice Document Server versions 6.0.0 and below Onlyoffice Core versions 6.1.0.26 and below **Description** A heap overflow issue was discovered in the component DesktopEditor/fontengine/fontconverter/FontFileBase.h. **Recommendations** For Onlyoffice Document Server versions 6.0.0 and below, update to a version above 6.0.0. For Onlyoffice Core versions 6.1.0.26 and below, update to a version above 6.1.0.26.