Openoffice (Apache) - vulnerabilities (CVEs)

60 CVEs, 0 in the last 30 days, 52 known versions, newest CVE from 2025-11-12. Vendor: Apache.

CVEs of Openoffice

CVE-2025-64407 - CVSS 5.3 (medium), 2025-11-12: Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would…
CVE-2025-64402 - CVSS 6.5 (medium), 2025-11-12: Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would…
CVE-2025-64405 - CVSS 7.5 (high), 2025-11-12: Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would…
CVE-2025-64404 - CVSS 7.5 (high), 2025-11-12: Apache OpenOffice documents can contain links to other files. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a…
CVE-2025-64403 - CVSS 8.1 (high), 2025-11-12: Apache OpenOffice Calc spreadsheet can contain links to other files, in the form of "external data sources". A missing Authorization vulnerability in Apache…
CVE-2025-64406 - CVSS 4.3 (medium), 2025-11-12: An out-of-bounds Write vulnerability in Apache OpenOffice could allow an attacker to craft a document that would crash the program, or otherwise corrupt other…
CVE-2025-64401 - CVSS 7.5 (high), 2025-11-12: Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would…
CVE-2023-47804 - CVSS 8.8 (high), 2023-12-29: Apache OpenOffice documents can contain links that call internal macros with arbitrary arguments. Several URI Schemes are defined for this purpose. Links can…
CVE-2022-38745 - CVSS 7.8 (high), 2023-03-24: Apache OpenOffice versions before 4.1.14 may be configured to add an empty entry to the Java class path. This may lead to run arbitrary Java code from the…
CVE-2022-47502 - CVSS 7.8 (high), 2023-03-24: Apache OpenOffice documents can contain links that call internal macros with arbitrary arguments. Several URI Schemes are defined for this purpose. Links can…
CVE-2022-37401 - CVSS 8.8 (high), 2022-08-15: Apache OpenOffice supports the storage of passwords for web connections in the user's configuration database. The stored passwords are encrypted with a single…
CVE-2022-37400 - CVSS 8.8 (high), 2022-08-15: Apache OpenOffice supports the storage of passwords for web connections in the user's configuration database. The stored passwords are encrypted with a single…
CVE-2021-41832 - CVSS 7.5 (high), 2021-10-11: It is possible for an attacker to manipulate documents to appear to be signed by a trusted source. All versions of Apache OpenOffice up to 4.1.10 are…
CVE-2021-41831 - CVSS 5.3 (medium), 2021-10-11: It is possible for an attacker to manipulate the timestamp of signed documents. All versions of Apache OpenOffice up to 4.1.10 are affected. Users are advised…
CVE-2021-41830 - CVSS 7.5 (high), 2021-10-11: It is possible for an attacker to manipulate signed documents and macros to appear to come from a trusted source. All versions of Apache OpenOffice up to…
CVE-2021-40439 - CVSS 6.5 (medium), 2021-10-07: Apache OpenOffice has a dependency on expat software. Versions prior to 2.1.0 were subject to CVE-2013-0340 a "Billion Laughs" entity expansion denial of…
CVE-2021-28129 - CVSS 7.8 (high), 2021-10-07: While working on Apache OpenOffice 4.1.8 a developer discovered that the DEB package did not install using root, but instead used a userid and groupid of 500.…
CVE-2021-33035 - CVSS 7.8 (high), 2021-09-23: Apache OpenOffice opens dBase/DBF documents and shows the contents as spreadsheets. DBF are database files with data organized in fields. When reading DBF…
CVE-2021-30245 - CVSS 8.8 (high), 2021-04-15: The project received a report that all versions of Apache OpenOffice through 4.1.8 can open non-http(s) hyperlinks. The problem has existed since about 2006…
CVE-2020-13958 - CVSS 7.8 (high), 2020-11-17: A vulnerability in Apache OpenOffice scripting events allows an attacker to construct documents containing hyperlinks pointing to an executable on the target…
CVE-2012-5639 - CVSS 6.5 (medium), 2019-12-20: LibreOffice and OpenOffice automatically open embedded content
CVE-2011-2177 - CVSS 7.8 (high), 2019-11-27: OpenOffice.org v3.3 allows execution of arbitrary code with the privileges of the user running the OpenOffice.org suite tools.
CVE-2018-11790 - CVSS 7.8 (high), 2019-01-31: When loading a document with Apache Open Office 4.1.5 and earlier with smaller end line termination than the operating system uses, the defect occurs. In this…
CVE-2018-10583 - CVSS 7.5 (high), 2018-05-01: An information disclosure vulnerability occurs when LibreOffice 6.0.3 and Apache OpenOffice Writer 4.1.5 automatically process and initiate an SMB connection…
CVE-2017-12608 - CVSS 7.8 (high), 2017-11-20: A vulnerability in Apache OpenOffice Writer DOC file parser before 4.1.4, and specifically in ImportOldFormatStyles, allows attackers to craft malicious…
CVE-2017-3157 - CVSS 5.5 (medium), 2017-11-20: By exploiting the way Apache OpenOffice before 4.1.4 renders embedded objects, an attacker could craft a document that allows reading in a file from the…
CVE-2017-12607 - CVSS 7.8 (high), 2017-11-20: A vulnerability in OpenOffice's PPT file parser before 4.1.4, and specifically in PPTStyleSheet, allows attackers to craft malicious documents that cause…
CVE-2017-9806 - CVSS 7.8 (high), 2017-11-20: A vulnerability in the OpenOffice Writer DOC file parser before 4.1.4, and specifically in the WW8Fonts Constructor, allows attackers to craft malicious…
CVE-2016-6804 - CVSS 7.8 (high), 2017-11-20: The Apache OpenOffice installer (versions prior to 4.1.3, including some branded as OpenOffice.org) for Windows contains a defective operation that allows…
CVE-2016-6803 - CVSS 7.8 (high), 2017-11-13: An installer defect known as an "unquoted Windows search path vulnerability" affected the Apache OpenOffice before 4.1.3 installers for Windows. The PC must…
CVE-2016-1513 - CVSS 7.8 (high), 2016-08-05: The Impress tool in Apache OpenOffice 4.1.2 and earlier allows remote attackers to cause a denial of service (out-of-bounds read or write) or execute…
CVE-2015-5214 - CVSS 6.8 (medium), 2015-11-10: LibreOffice before 4.4.6 and 5.x before 5.0.1 and Apache OpenOffice before 4.1.2 allows remote attackers to cause a denial of service (memory corruption and…
CVE-2015-5213 - CVSS 6.8 (medium), 2015-11-10: Integer overflow in LibreOffice before 4.4.5 and Apache OpenOffice before 4.1.2 allows remote attackers to cause a denial of service (memory corruption and…
CVE-2015-5212 - CVSS 6.8 (medium), 2015-11-10: Integer underflow in LibreOffice before 4.4.5 and Apache OpenOffice before 4.1.2, when the configuration setting "Load printer settings with the document" is…
CVE-2015-4551 - CVSS 4.3 (medium), 2015-11-10: LibreOffice before 4.4.5 and Apache OpenOffice before 4.1.2 uses the stored LinkUpdateMode configuration information in OpenDocument Format files and…
CVE-2015-1774 - CVSS 6.8 (medium), 2015-04-28: The HWP filter in LibreOffice before 4.3.7 and 4.4.x before 4.4.2 and Apache OpenOffice before 4.1.2 allows remote attackers to cause a denial of service…
CVE-2014-3575 - CVSS 4.3 (medium), 2014-08-27: The OLE preview generation in Apache OpenOffice before 4.1.1 and OpenOffice.org (OOo) might allow remote attackers to embed arbitrary data into documents via…
CVE-2014-3524 - CVSS 9.3 (critical), 2014-08-26: Apache OpenOffice before 4.1.1 allows remote attackers to execute arbitrary commands and possibly have other unspecified impact via a crafted Calc spreadsheet.
CVE-2013-4156 - CVSS 6.8 (medium), 2013-07-31: Apache OpenOffice.org (OOo) before 4.0 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via…
CVE-2013-2189 - CVSS 6.8 (medium), 2013-07-31: Apache OpenOffice.org (OOo) before 4.0 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via…
CVE-2012-2665 - CVSS 7.5 (high), 2012-08-06: Multiple heap-based buffer overflows in the XML manifest encryption tag parsing functionality in OpenOffice.org and LibreOffice before 3.5.5 allow remote…
CVE-2012-0037 - CVSS 6.5 (medium), 2012-06-17: Redland Raptor (aka libraptor) before 2.0.7, as used by OpenOffice 3.3 and 3.4 Beta, LibreOffice before 3.4.6 and 3.5.x before 3.5.1, and other products,…
CVE-2010-3452 - CVSS 9.3 (critical), 2011-01-28: Use-after-free vulnerability in oowriter in OpenOffice.org (OOo) 2.x and 3.x before 3.3 allows remote attackers to cause a denial of service (application…
CVE-2010-3689 - CVSS 6.9 (medium), 2011-01-28: soffice in OpenOffice.org (OOo) 3.x before 3.3 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a…
CVE-2010-3451 - CVSS 9.3 (critical), 2011-01-28: Use-after-free vulnerability in oowriter in OpenOffice.org (OOo) 2.x and 3.x before 3.3 allows remote attackers to cause a denial of service (application…
CVE-2010-3454 - CVSS 9.3 (critical), 2011-01-28: Multiple off-by-one errors in the WW8DopTypography::ReadFromMem function in oowriter in OpenOffice.org (OOo) 2.x and 3.x before 3.3 allow remote attackers to…
CVE-2010-4643 - CVSS 9.3 (critical), 2011-01-28: Heap-based buffer overflow in Impress in OpenOffice.org (OOo) 2.x and 3.x before 3.3 allows remote attackers to cause a denial of service (application crash)…
CVE-2010-3450 - CVSS 9.3 (critical), 2011-01-28: Multiple directory traversal vulnerabilities in OpenOffice.org (OOo) 2.x and 3.x before 3.3 allow remote attackers to overwrite arbitrary files via a .. (dot…
CVE-2010-3453 - CVSS 9.3 (critical), 2011-01-28: The WW8ListManager::WW8ListManager function in oowriter in OpenOffice.org (OOo) 2.x and 3.x before 3.3 does not properly handle an unspecified number of list…
CVE-2010-4253 - CVSS 9.3 (critical), 2011-01-28: Heap-based buffer overflow in Impress in OpenOffice.org (OOo) 2.x and 3.x before 3.3 allows remote attackers to cause a denial of service (application crash)…
CVE-2010-4494 - CVSS 7.5 (high), 2010-12-07: Double free vulnerability in libxml2 2.7.8 and other versions, as used in Google Chrome before 8.0.552.215 and other products, allows remote attackers to…
CVE-2010-4008 - CVSS 4.3 (medium), 2010-11-17: libxml2 before 2.7.8, as used in Google Chrome before 7.0.517.44, Apple Safari 5.0.2 and earlier, and other products, reads from invalid memory locations…
CVE-2010-0395 - CVSS 9.3 (critical), 2010-06-10: OpenOffice.org 2.x and 3.0 before 3.2.1 allows user-assisted remote attackers to bypass Python macro security restrictions and execute arbitrary Python code…
CVE-2010-0136 - CVSS 9.3 (critical), 2010-02-16: OpenOffice.org (OOo) 2.0.4, 2.4.1, and 3.1.1 does not properly enforce Visual Basic for Applications (VBA) macro security settings, which allows remote…
CVE-2009-2949 - CVSS 9.3 (critical), 2010-02-16: Integer overflow in the XPMReader::ReadXPM function in filter.vcl/ixpm/svt_xpmread.cxx in OpenOffice.org (OOo) before 3.2 allows remote attackers to execute…
CVE-2009-3302 - CVSS 9.3 (critical), 2010-02-16: filter/ww8/ww8par2.cxx in OpenOffice.org (OOo) before 3.2 allows remote attackers to cause a denial of service (application crash) or possibly execute…
CVE-2009-3301 - CVSS 9.3 (critical), 2010-02-16: Integer underflow in filter/ww8/ww8par2.cxx in OpenOffice.org (OOo) before 3.2 allows remote attackers to cause a denial of service (application crash) or…
CVE-2009-2950 - CVSS 9.3 (critical), 2010-02-16: Heap-based buffer overflow in the GIFLZWDecompressor::GIFLZWDecompressor function in filter.vcl/lgif/decode.cxx in OpenOffice.org (OOo) before 3.2 allows…
CVE-2008-3282 - CVSS 7.8 (high), 2008-08-29: Integer overflow in the rtl_allocateMemory function in sal/rtl/source/alloc_global.c in the memory allocator in OpenOffice.org (OOo) 2.4.1, on 64-bit…
CVE-2007-2834 - CVSS 9.3 (critical), 2007-09-18: Integer overflow in the TIFF parser in OpenOffice.org (OOo) before 2.3; and Sun StarOffice 6, 7, and 8 Office Suite (StarSuite); allows remote attackers to…