LibreOffice and OpenOffice Flaws Let Malicious Spreadsheets Run Code Without Macro Warnings
Overview
Security researchers have discovered vulnerabilities in LibreOffice and Apache OpenOffice that allow malicious spreadsheets to execute code without displaying any warning to users. This exploit occurs when the Java support feature is enabled in these applications. The researchers demonstrated this as a proof of concept, meaning it hasn't been seen in real-world attacks yet. However, this lack of a warning when opening potentially harmful files raises serious concerns about user safety. It's crucial for users of these office suites to be aware of this risk, especially if they have Java support active.
Key Takeaways
- Affected Systems: LibreOffice, Apache OpenOffice
- Action Required: Users should disable Java support in LibreOffice and Apache OpenOffice until a patch is available to mitigate this vulnerability.
- Timeline: Newly disclosed
Original Article Summary
A malicious spreadsheet can make LibreOffice and Apache OpenOffice run an attacker's code as soon as the file is opened, security researchers have shown. There is no warning first, of the kind either program shows before it runs a macro. The attack works only when the program's Java support is enabled. So far, it has only been shown as a proof of concept, and there are no reports of its use in
Impact
LibreOffice, Apache OpenOffice
Exploitation Status
No active exploitation has been reported at this time. However, organizations should still apply patches promptly as proof-of-concept code may exist.
Timeline
Newly disclosed
Remediation
Users should disable Java support in LibreOffice and Apache OpenOffice until a patch is available to mitigate this vulnerability.
Additional Information
This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.
Related Topics: This incident relates to Exploit, Malware, Apache.