REDHAT-BUG-2545885: High severity LibreOffice LibreOffice Calc vulnerability
LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A document could name a Java database driver for such a link to be loaded from a remote location, so opening the document could run Java code from that location. In fixed versions an entry in a Java class path has to be a file URL.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure every entry in the Java class path is a file URL.
Java class path Classpath entry URL scheme = file URL
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker needs to persuade a user to open a Calc document containing an external data-source link that names a Java database driver at a remote location. Opening the document can cause LibreOffice Calc to load the driver and run Java code from that location.
Which documents should be treated as potentially dangerous?
Treat Calc documents with saved links to external data sources as potentially dangerous, especially where the link specifies a Java database driver from a remote location. The provided information does not describe a way to determine whether a particular document contains such a link.
What changes in fixed versions?
Fixed versions require entries in a Java class path to use a file URL. This prevents the described loading of a Java database driver from a remote location.
What can be done before applying an update?
Avoid opening untrusted Calc documents that may contain external data-source links, particularly documents that could reference remote Java database drivers. The provided information does not specify any additional workaround or configuration mitigation.