The remote SUSE Linux SLED12 / SLED_SAP12 / SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0075-1 advisory.

  - Improper Validation of Array Index vulnerability in the spreadsheet component of The Document Foundation     LibreOffice allows an attacker to craft a spreadsheet document that will cause an array index underflow     when loaded. In the affected versions of LibreOffice certain malformed spreadsheet formulas, such as     AGGREGATE, could be created with less parameters passed to the formula interpreter than it expected,     leading to an array index underflow, in which case there is a risk that arbitrary code could be executed.
    This issue affects: The Document Foundation LibreOffice 7.4 versions prior to 7.4.6; 7.5 versions prior to     7.5.1. (CVE-2023-0950)

  - Improper access control in editor components of The Document Foundation LibreOffice allowed an attacker to     craft a document that would cause external links to be loaded without prompt. In the affected versions of     LibreOffice documents that used floating frames linked to external files, would load the contents of     those frames without prompting the user for permission to do so. This was inconsistent with the treatment     of other linked content in LibreOffice. This issue affects: The Document Foundation LibreOffice 7.4     versions prior to 7.4.7; 7.5 versions prior to 7.5.3. (CVE-2023-2255)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2023-7005:05 advisory.

    * libreoffice: Empty entry in Java class path (CVE-2022-38745)
      * libreoffice: Array index underflow in Calc formula parsing (CVE-2023-0950)
      * libreoffice: Arbitrary file write (CVE-2023-1183)
      * libreoffice: Remote documents loaded without prompt via IFrame (CVE-2023-2255)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2023:6933 advisory.

  - Apache OpenOffice versions before 4.1.14 may be configured to add an empty entry to the Java class path.
    This may lead to run arbitrary Java code from the current directory. (CVE-2022-38745)

  - Improper Validation of Array Index vulnerability in the spreadsheet component of The Document Foundation     LibreOffice allows an attacker to craft a spreadsheet document that will cause an array index underflow     when loaded. In the affected versions of LibreOffice certain malformed spreadsheet formulas, such as     AGGREGATE, could be created with less parameters passed to the formula interpreter than it expected,     leading to an array index underflow, in which case there is a risk that arbitrary code could be executed.
    This issue affects: The Document Foundation LibreOffice 7.4 versions prior to 7.4.6; 7.5 versions prior to     7.5.1. (CVE-2023-0950)

  - A flaw was found in the Libreoffice package. An attacker can craft an odb containing a database/script     file with a SCRIPT command where the contents of the file could be written to a new file whose location     was determined by the attacker. (CVE-2023-1183)

  - Improper access control in editor components of The Document Foundation LibreOffice allowed an attacker to     craft a document that would cause external links to be loaded without prompt. In the affected versions of     LibreOffice documents that used floating frames linked to external files, would load the contents of     those frames without prompting the user for permission to do so. This was inconsistent with the treatment     of other linked content in LibreOffice. This issue affects: The Document Foundation LibreOffice 7.4     versions prior to 7.4.7; 7.5 versions prior to 7.5.3. (CVE-2023-2255)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-6508 advisory.

    - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula       Parsing
    - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded       without prompt via IFrame
    - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Improper access control in editor components of The Document Foundation LibreOffice allowed an attacker to     craft a document that would cause external links to be loaded without prompt. In the affected versions of     LibreOffice documents that used floating frames linked to external files, would load the contents of     those frames without prompting the user for permission to do so. This was inconsistent with the treatment     of other linked content in LibreOffice. This issue affects: The Document Foundation LibreOffice 7.4     versions prior to 7.4.7; 7.5 versions prior to 7.5.3. (CVE-2023-2255)

Note that Nessus relies on the presence of the package as reported by the vendor.

Improper access control in editor components of The Document Foundation LibreOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt. In the affected versions of LibreOffice documents that used 'floating frames' linked to external files, would load the contents of those frames without prompting the user for permission to do so. This was inconsistent with the treatment of other linked content in LibreOffice. This issue affects: The Document Foundation LibreOffice 7.4 versions prior to 7.4.7; 7.5 versions prior to 7.5.3.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6144-1 advisory.

    It was discovered that LibreOffice did not properly validate the number of parameters passed to the     formula interpreter, leading to an array index underflow attack. If a user were tricked into opening a     specially crafted spreadsheet file, an attacker could possibly use this issue to execute arbitrary code.
    (CVE-2023-0950)

    Amel Bouziane-Leblond discovered that LibreOffice did not prompt the user before loading the host document     inside an IFrame. If a user were tricked into opening a specially crafted input file, an attacker could     possibly use this issue to cause information disclosure or execute arbitrary code. (CVE-2023-2255)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the libreoffice-7.1.8.1-11.el9 build changelog.

  - Improper Validation of Array Index vulnerability in the spreadsheet component of The Document Foundation     LibreOffice allows an attacker to craft a spreadsheet document that will cause an array index underflow     when loaded. In the affected versions of LibreOffice certain malformed spreadsheet formulas, such as     AGGREGATE, could be created with less parameters passed to the formula interpreter than it expected,     leading to an array index underflow, in which case there is a risk that arbitrary code could be executed.
    This issue affects: The Document Foundation LibreOffice 7.4 versions prior to 7.4.6; 7.5 versions prior to     7.5.1. (CVE-2023-0950)

  - Arbitrary File Write (CVE-2023-1183)

  - Remote documents loaded without prompt via IFrame (CVE-2023-2255)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-6933 advisory.

    - Resolves: rhbz#2210191 CVE-2023-0950 Array Index UnderFlow in Calc Formula       Parsing
    - Resolves: rhbz#2210195 CVE-2023-2255 libreoffice: Remote documents loaded       without prompt via IFrame
    - Resolves: rhbz#2208509 CVE-2023-1183 libreoffice: Arbitrary File Write

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2024:0072 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2022-26305:
    An Improper Certificate Validation vulnerability in LibreOffice existed where determining if a macro was     signed by a trusted author was done by only matching the serial number and issuer string of the used     certificate with that of a trusted certificate. This is not sufficient to verify that the macro was     actually signed with the certificate. An adversary could therefore create an arbitrary certificate with a     serial number and an issuer string identical to a trusted certificate which LibreOffice would present as     belonging to the trusted author, potentially leading to the user to execute arbitrary code contained in     macros improperly trusted. This issue affects: The Document Foundation LibreOffice 7.2 versions prior to     7.2.7; 7.3 versions prior to 7.3.1.

    CVE-2022-26306:
    LibreOffice supports the storage of passwords for web connections in the users configuration database.
    The stored passwords are encrypted with a single master key provided by the user. A flaw in LibreOffice     existed where the required initialization vector for encryption was always the same which weakens the     security of the encryption making them vulnerable if an attacker has access to the user's configuration     data. This issue affects: The Document Foundation LibreOffice 7.2 versions prior to 7.2.7; 7.3 versions     prior to 7.3.1.

    CVE-2022-26307:
    LibreOffice supports the storage of passwords for web connections in the users configuration database.
    The stored passwords are encrypted with a single master key provided by the user. A flaw in LibreOffice     existed where master key was poorly encoded resulting in weakening its entropy from 128 to 43 bits making     the stored passwords vulerable to a brute force attack if an attacker has access to the users stored     config. This issue affects: The Document Foundation LibreOffice 7.2 versions prior to 7.2.7; 7.3 versions     prior to 7.3.3.

    CVE-2022-3140:
    LibreOffice supports Office URI Schemes to enable browser integration of LibreOffice with MS SharePoint     server. An additional scheme 'vnd.libreoffice.command' specific to LibreOffice was added. In the affected     versions of LibreOffice links using that scheme could be constructed to call internal macros with     arbitrary arguments. Which when clicked on, or activated by document events, could result in arbitrary     script execution without warning. This issue affects: The Document Foundation LibreOffice 7.4 versions     prior to 7.4.1; 7.3 versions prior to 7.3.6.

    CVE-2022-38745:
    Apache OpenOffice versions before 4.1.14 may be configured to add an empty entry to the Java class path.
    This may lead to run arbitrary Java code from the current directory.

    CVE-2023-0950:
    Improper Validation of Array Index vulnerability in the spreadsheet component of The Document Foundation     LibreOffice allows an attacker to craft a spreadsheet document that will cause an array index underflow     when loaded. In the affected versions of LibreOffice certain malformed spreadsheet formulas, such as     AGGREGATE, could be created with less parameters passed to the formula interpreter than it expected,     leading to an array index underflow, in which case there is a risk that arbitrary code could be executed.
    This issue affects: The Document Foundation LibreOffice 7.4 versions prior to 7.4.6; 7.5 versions prior to     7.5.1.

    CVE-2023-1183:
    A flaw was found in the Libreoffice package. An attacker can craft an odb containing a database/script     file with a SCRIPT command where the contents of the file could be written to a new file whose location     was determined by the attacker.

    CVE-2023-2255:
    Improper access control in editor components of The Document Foundation LibreOffice allowed an attacker to     craft a document that would cause external links to be loaded without prompt. In the affected versions of     LibreOffice documents that used floating frames linked to external files, would load the contents of     those frames without prompting the user for permission to do so. This was inconsistent with the treatment     of other linked content in LibreOffice. This issue affects: The Document Foundation LibreOffice 7.4     versions prior to 7.4.7; 7.5 versions prior to 7.5.3.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2023-7259:06 advisory.

    * libreoffice: Empty entry in Java class path (CVE-2022-38745)
      * libreoffice: Array index underflow in Calc formula parsing (CVE-2023-0950)
      * libreoffice: Arbitrary file write (CVE-2023-1183)
      * libreoffice: Remote documents loaded without prompt via IFrame (CVE-2023-2255)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
187939	SUSE SLED12 / SLES12 Security Update : LibreOffice (SUSE-SU-2024:0075-1)	Nessus	SuSE Local Security Checks	2024/1/11	2024/1/11	high
291883	MiracleLinux 9 : libreoffice-7.1.8.1-11.el9.ML.2 (AXSA:2023-7005:05)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	high
185632	CentOS 8 : libreoffice (CESA-2023:6933)	Nessus	CentOS Local Security Checks	2023/11/14	2023/12/15	high
185872	Oracle Linux 9 : libreoffice (ELSA-2023-6508)	Nessus	Oracle Linux Local Security Checks	2023/11/16	2025/9/9	high
227001	Linux Distros Unpatched Vulnerability : CVE-2023-2255	Nessus	Misc.	2025/3/5	2025/10/28	medium
176671	LibreOffice 7.4 < 7.4.7 / 7.5 < 7.5.3 Array Index UnderFlow (macOS)	Nessus	MacOS X Local Security Checks	2023/6/5	2023/12/15	medium
176885	Ubuntu 20.04 LTS / 22.04 LTS : LibreOffice vulnerabilities (USN-6144-1)	Nessus	Ubuntu Local Security Checks	2023/6/7	2024/8/27	high
176673	LibreOffice 7.4 < 7.4.7 / 7.5 < 7.5.3 Array Index UnderFlow (Windows)	Nessus	Windows	2023/6/5	2023/12/15	medium
191157	CentOS 9 : libreoffice-7.1.8.1-11.el9	Nessus	CentOS Local Security Checks	2024/2/29	2024/4/26	high
186134	Oracle Linux 8 : libreoffice (ELSA-2023-6933)	Nessus	Oracle Linux Local Security Checks	2023/11/21	2025/9/9	high
236157	Alibaba Cloud Linux 3 : 0072: libreoffice (ALINUX3-SA-2024:0072)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	high
292282	MiracleLinux 8 : libreoffice-6.4.7.2-15.el8.ML.1 (AXSA:2023-7259:06)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	high

检测

插件搜索

high

high

high

high

medium

medium

high

medium

high

high

high

high