Apache Openoffice (Apache Software Foundation) - vulnerabilities (CVEs)

27 CVEs, 1 in the last 30 days, 1 known versions, newest CVE from 2026-10-02. Vendor: Apache Software Foundation.

CVEs of Apache Openoffice

CVE-2026-59265 - CVSS 8.8 (high), 2026-10-02: A code execution issue in the Java integration in Apache OpenOffice v4.1.16 and earlier allows a crafted untrusted document to trigger executing arbitrary…
CVE-2025-64407 - CVSS 5.3 (medium), 2025-11-12: Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would…
CVE-2025-64404 - CVSS 7.5 (high), 2025-11-12: Apache OpenOffice documents can contain links to other files. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a…
CVE-2025-64403 - CVSS 8.1 (high), 2025-11-12: Apache OpenOffice Calc spreadsheet can contain links to other files, in the form of "external data sources". A missing Authorization vulnerability in Apache…
CVE-2025-64406 - CVSS 4.3 (medium), 2025-11-12: An out-of-bounds Write vulnerability in Apache OpenOffice could allow an attacker to craft a document that would crash the program, or otherwise corrupt other…
CVE-2025-64402 - CVSS 6.5 (medium), 2025-11-12: Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would…
CVE-2025-64405 - CVSS 7.5 (high), 2025-11-12: Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would…
CVE-2025-64401 - CVSS 7.5 (high), 2025-11-12: Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would…
CVE-2023-47804 - CVSS 8.8 (high), 2023-12-29: Apache OpenOffice documents can contain links that call internal macros with arbitrary arguments. Several URI Schemes are defined for this purpose. Links can…
CVE-2022-47502 - CVSS 7.8 (high), 2023-03-24: Apache OpenOffice documents can contain links that call internal macros with arbitrary arguments. Several URI Schemes are defined for this purpose. Links can…
CVE-2022-38745 - CVSS 7.8 (high), 2023-03-24: Apache OpenOffice versions before 4.1.14 may be configured to add an empty entry to the Java class path. This may lead to run arbitrary Java code from the…
CVE-2022-37401 - CVSS 8.8 (high), 2022-08-15: Apache OpenOffice supports the storage of passwords for web connections in the user's configuration database. The stored passwords are encrypted with a single…
CVE-2022-37400 - CVSS 8.8 (high), 2022-08-15: Apache OpenOffice supports the storage of passwords for web connections in the user's configuration database. The stored passwords are encrypted with a single…
CVE-2021-41832 - CVSS 7.5 (high), 2021-10-11: It is possible for an attacker to manipulate documents to appear to be signed by a trusted source. All versions of Apache OpenOffice up to 4.1.10 are…
CVE-2021-41831 - CVSS 5.3 (medium), 2021-10-11: It is possible for an attacker to manipulate the timestamp of signed documents. All versions of Apache OpenOffice up to 4.1.10 are affected. Users are advised…
CVE-2021-41830 - CVSS 7.5 (high), 2021-10-11: It is possible for an attacker to manipulate signed documents and macros to appear to come from a trusted source. All versions of Apache OpenOffice up to…
CVE-2021-40439 - CVSS 6.5 (medium), 2021-10-07: Apache OpenOffice has a dependency on expat software. Versions prior to 2.1.0 were subject to CVE-2013-0340 a "Billion Laughs" entity expansion denial of…
CVE-2021-28129 - CVSS 7.8 (high), 2021-10-07: While working on Apache OpenOffice 4.1.8 a developer discovered that the DEB package did not install using root, but instead used a userid and groupid of 500.…
CVE-2021-33035 - CVSS 7.8 (high), 2021-09-23: Apache OpenOffice opens dBase/DBF documents and shows the contents as spreadsheets. DBF are database files with data organized in fields. When reading DBF…
CVE-2021-30245 - CVSS 8.8 (high), 2021-04-15: The project received a report that all versions of Apache OpenOffice through 4.1.8 can open non-http(s) hyperlinks. The problem has existed since about 2006…
CVE-2018-11790 - CVSS 7.8 (high), 2019-01-31: When loading a document with Apache Open Office 4.1.5 and earlier with smaller end line termination than the operating system uses, the defect occurs. In this…
CVE-2017-3157 - CVSS 5.5 (medium), 2017-11-20: By exploiting the way Apache OpenOffice before 4.1.4 renders embedded objects, an attacker could craft a document that allows reading in a file from the…
CVE-2017-12608 - CVSS 7.8 (high), 2017-11-20: A vulnerability in Apache OpenOffice Writer DOC file parser before 4.1.4, and specifically in ImportOldFormatStyles, allows attackers to craft malicious…
CVE-2017-12607 - CVSS 7.8 (high), 2017-11-20: A vulnerability in OpenOffice's PPT file parser before 4.1.4, and specifically in PPTStyleSheet, allows attackers to craft malicious documents that cause…
CVE-2017-9806 - CVSS 7.8 (high), 2017-11-20: A vulnerability in the OpenOffice Writer DOC file parser before 4.1.4, and specifically in the WW8Fonts Constructor, allows attackers to craft malicious…
CVE-2016-6804 - CVSS 7.8 (high), 2017-11-20: The Apache OpenOffice installer (versions prior to 4.1.3, including some branded as OpenOffice.org) for Windows contains a defective operation that allows…
CVE-2016-6803 - CVSS 7.8 (high), 2017-11-13: An installer defect known as an "unquoted Windows search path vulnerability" affected the Apache OpenOffice before 4.1.3 installers for Windows. The PC must…