https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-03T21:33:31.445383+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2024-12425 CVE-2024-12425 — Path traversal leading to arbitrary .ttf file write 2026-10-03T21:33:31.449278+00:00

Affected: The Document Foundation LibreOffice

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The Document Foundation LibreOffice allows Absolute Path Traversal.

An attacker can write to arbitrary locations, albeit suffixed with ".ttf", by supplying a file in a format that supports embedded font files.

This issue affects LibreOffice: from 24.8 before < 24.8.4.

 https://vulnerability.circl.lu/vuln/usn-7228-1 USN-7228-1 — libreoffice vulnerabilities 2026-10-03T21:33:31.449389+00:00

Affected: Ubuntu:20.04:LTS: libreoffice, Ubuntu:22.04:LTS: libreoffice, Ubuntu:24.04:LTS: libreoffice

Thomas Rinsma discovered that LibreOffice incorrectly handled paths when processing embedded font files. If a user or automated system were tricked into opening a specially crafted LibreOffice file, a remote attacker could possibly use this issue to create arbitrary files ending with ".ttf". (CVE-2024-12425)

Thomas Rinsma discovered that LibreOffice incorrectly handled certain environment variables and INI file values. If a user or automated system were tricked into opening a specially crafted LibreOffice file, a remote attacker could possibly use this issue to exfiltrate sensitive information. (CVE-2024-12426)