=====================================================================

                               CERT-Renater

                    Note d'Information No. 2023/VULN119

_____________________________________________________________________

DATE                : 28/03/2023

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Apache OpenOffice versions prior
                                      to 4.1.14.

=====================================================================
https://www.openoffice.org/security/cves/CVE-2022-38745.html
https://www.openoffice.org/security/cves/CVE-2022-40674.html
https://www.openoffice.org/security/cves/CVE-2022-47502.html
_____________________________________________________________________


  An empty class path may lead to run arbitrary Java code

Fixed in Apache OpenOffice 4.1.14


Description

Apache OpenOffice versions before 4.1.14 may be configured to add
an empty entry to the Java class path. This may lead to run arbitrary
Java code from the current directory.

Severity: Moderate

There are no known exploits of this vulnerability.
A proof-of-concept demonstration does not exist.

Thanks to the reporter for discovering this issue.

Vendor: The Apache Software Foundation


Versions Affected

All Apache OpenOffice versions 4.1.13 and older are affected.
OpenOffice.org versions may also be affected.


Mitigation

Install Apache OpenOffice 4.1.14 for the latest maintenance and
cumulative security fixes. Use the Apache OpenOffice download page.


Acknowledgments

The Apache OpenOffice Security Team would like to thank the European
Commission's Open Source Programme Office for discovering and
reporting this attack vector.


Further Information

For additional information and assistance, consult the Apache
OpenOffice Community Forums or make requests to the
users@openoffice.apache.org public mailing list.

The latest information on Apache OpenOffice security bulletins
can be found at the Bulletin Archive page.
_____________________________________________________________________

  "Use after free" fixed in expat >= 2.4.9

Fixed in Apache OpenOffice 4.1.14


Description

libexpat before 2.4.9 has a use-after-free in the doContent function
in xmlparse.c.

Severity: Moderate

There are no known exploits of this vulnerability.
A proof-of-concept demonstration does not exist.

Vendor: The Apache Software Foundation


Versions Affected

All Apache OpenOffice versions 4.1.13 and older are affected.
OpenOffice.org versions may also be affected.


Mitigation

Install Apache OpenOffice 4.1.14 for the latest maintenance and
cumulative security fixes. Use the Apache OpenOffice download page.


Further Information

For additional information and assistance, consult the Apache
OpenOffice Community Forums or make requests to the
users@openoffice.apache.org public mailing list.

The latest information on Apache OpenOffice security bulletins can
be found at the Bulletin Archive page.
_____________________________________________________________________

  Macro URL arbitrary script execution without warning

Fixed in Apache OpenOffice 4.1.14

Description

Apache OpenOffice documents can contain links that call internal macros
with arbitrary arguments. Several URI Schemes are defined for this
purpose.Links can be activated by clicks, or by automatic document
events. The execution of such links must be subject to user approval.I
n the affected versions of OpenOffice, approval for certain links isn
ot requested; when activated, such links could therefore result in
arbitrary script execution.

Severity: Critical

There are no known exploits of this vulnerability.
A proof-of-concept demonstration exists.

Thanks to the reporter for discovering this issue.

Vendor: The Apache Software Foundation


Versions Affected

All Apache OpenOffice versions 4.1.13 and older are affected.
OpenOffice.org versions may also be affected.


Mitigation

Install Apache OpenOffice 4.1.14 for the latest maintenance and
cumulative security fixes. Use the Apache OpenOffice download
page.


Acknowledgments

The Apache OpenOffice Security Team would like to thank Altin
Thartori (tin-z) for discovering and reporting this attack
vector.


Further Information

For additional information and assistance, consult the Apache
OpenOffice Community Forums or make requests to the
users@openoffice.apache.org public mailing list.

The latest information on Apache OpenOffice security bulletins can
be found at the Bulletin Archive page.
=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================