CVE-2025-64407

Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would cause external links <br /> to be loaded without prompt. Such links could also be used to transmit system information, such as environment variables or configuration settings.<br /> <br /> In the affected versions of Apache OpenOffice, documents that used a certain URI scheme linking to external files would <br /> load the contents of such files without prompting the user for <br /> permission to do so. Such URI scheme allows to include system configuration data, that is not supposed to be transmitted externally.<br /> <br /> This issue affects Apache OpenOffice: through 4.1.15.<br /> <br /> Users are recommended to upgrade to version 4.1.16, which fixes the issue.<br /> <br /> <br /> <br /> <br /> <br /> The LibreOffice suite reported this issue as CVE-2024-12426.