PT-2024-10221 · Document Foundation+5 · Libreoffice+5

Thomas Rinsma · Published 2024-12-10 · Updated 2025-06-11 · CVE-2024-12426

Positive Technologies (AI Summary)

CVSS v4.0

6.7

Medium

Base vector

AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions LibreOffice versions 24.8 through 24.8.3

Description The issue is related to insufficient protection of internal data in LibreOffice, allowing an unauthorized actor to potentially disclose sensitive information. Specifically, URLs could be constructed to expand environmental variables or INI file values, leading to the exfiltration of potentially sensitive information to a remote server when opening a document containing such links.

Recommendations For LibreOffice versions 24.8 through 24.8.3, update to version 24.8.4 or later to resolve the issue. As a temporary workaround, consider restricting the use of URLs that could expand environmental variables or INI file values in documents until a patch is applied. Avoid using links that could potentially disclose sensitive information in documents until the issue is resolved.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

ALT-PU-2025-2262

ALT-PU-2025-4604

BDU:2025-00554

CVE-2024-12426

DLA-4020-1

DSA-5846-1

MGASA-2025-0035

USN-7228-1

Affected Products

Alt Linux

Astra Linux

Libreoffice

Linuxmint

Red Os

Ubuntu

References · 49

• https://ubuntu.com/security/notices/USN-7228-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2025-0035 · Vendor Advisory
• https://libreoffice.org/about-us/security/advisories/cve-2024-12426 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-12426 · Security Note
• https://osv.dev/vulnerability/DSA-5846-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2025-0422SE47 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-4020-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-12426 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-12425 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-12426 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2025-0035.html · Security Note
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2025-0319SE17 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-12426 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-12426 · Security Note