PT-2025-46582 · Apache · Apache Openoffice

Published 2025-11-12 · Updated 2025-11-12 · CVE-2025-64402

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Apache OpenOffice versions through 4.1.15

Description Apache OpenOffice documents can contain links. A missing authorization check in Apache OpenOffice allowed an attacker to create a document that would load external links without user confirmation. Specifically, documents utilizing "OLE objects" linked to external files would load the contents of those files without prompting the user for permission.

Recommendations Upgrade to version 4.1.16 to resolve this issue.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2025-15431

CVE-2025-64402

Affected Products

Apache Openoffice

References · 8

• https://lists.apache.org/thread/tssrl88tygjsgk6csllm6p2fb6tlv8d8 · Vendor Advisory
• https://openoffice.org/security/cves/CVE-2025-64402.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64402 · Security Note
• https://bdu.fstec.ru/vul/2025-15431 · Security Note
• https://osv.dev/vulnerability/CVE-2025-64402 · Vendor Advisory
• http://openwall.com/lists/oss-security/2025/11/11/5 · Note
• https://twitter.com/CVEnew/status/1988543000830783878 · Twitter Post
• https://t.me/cveNotify/142503 · Telegram Post