CVE-2025-1080

04.03.2025, 20:15

LibreOffice supports Office URI Schemes to enable browser integration of LibreOffice with MS SharePoint server. An additional scheme 'vnd.libreoffice.command' specific to LibreOffice was added. In the affected versions of LibreOffice a link in a browser using that scheme could be constructed with an embedded inner URL that when passed to LibreOffice could call internal macros with arbitrary arguments.
This issue affects LibreOffice: from 24.8 before < 24.8.5, from 25.2 before < 25.2.1.

Provider	Type	Base Score	Vector
NIST	NIST	UNKNOWN	---
Document Fdn.	CNA	---	---
CISA-ADP	ADP	---	---

Awaiting analysis

This vulnerability is currently awaiting analysis.

Base Score

CVSS 3.x

EPSS Score

Percentile: 12%

Debian Releases

Debian Product

Codename

libreoffice

bullseye	vulnerable
bullseye (security)	vulnerable
bookworm	4:7.4.7-1+deb12u7 fixed
bookworm (security)	4:7.4.7-1+deb12u7 fixed
sid	4:25.2.2-1 fixed
trixie	4:25.2.2-1 fixed

Ubuntu Releases

Ubuntu Product

Codename

libreoffice

oracular	Fixed 4:24.8.5-0ubuntu0.24.10.2 released
noble	Fixed 4:24.2.7-0ubuntu0.24.04.3 released
jammy	Fixed 1:7.3.7-0ubuntu0.22.04.9 released
focal	Fixed 1:6.4.7-0ubuntu0.20.04.14 released

Common Weakness Enumeration

CWE-20 - Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Vulnerability Media Exposure

[GERMAN] LibreOffice: Schwachstelle ermöglicht Codeausführung
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in LibreOffice ausnutzen, um beliebigen Programmcode auszuführen.
Published: 2025-03-04T23:00:00+00:00

References

https://www.libreoffice.org/about-us/security/advisories/cve-2025-1080