CVE-2021-30245

CVE-2021-30245: fallo en Apache OpenOffice

Code execution in Apache OpenOffice via non-http(s) schemes in Hyperlinks

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Apache OpenOffice

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

3Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackepss 4.9%
The project received a report that all versions of Apache OpenOffice through 4.1.8 can open non-http(s) hyperlinks. The problem has existed since about 2006 and the issue is also in 4.1.9. If the link is specifically crafted this could lead to untrusted code execution. It is always best practice to be careful opening documents from unknown and unverified sources. The mitigation in Apache OpenOffice 4.1.10 (unreleased) assures that a security warning is displayed giving the user the option of continuing to open the hyperlink.
Productos afectados
Apache Software Foundation · Apache OpenOffice
CVEs relacionadas — Apache OpenOffice

En el mismo producto, de las más peligrosas a las menos.

CVE-2021-33035—Buffer overflow from a crafted DBF fileEPSS 50.6%CVE-2021-40439—Billion LaughsEPSS 3.9%CVE-2017-3157—CVE-2017-3157EPSS 3.1%CVE-2016-6804—CVE-2016-6804EPSS 3.0%CVE-2017-12608—CVE-2017-12608EPSS 2.9%CVE-2023-47804—Apache OpenOffice: Macro URL arbitrary script executionEPSS 2.7%