[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f-sFgRlmuoZxcgWQGI5ba6JhhyXPFDAVIwYpzejFRSKM":3},{"success":4,"data":5},true,{"vendor":6,"topVulnerabilitiesByEpss":19,"kevVulnerabilities":83,"topProductsByCves":84,"seoMetadata":86,"meta":95},{"vendorId":7,"vendorName":8,"productCount":9,"cveCount":10,"kevCount":11,"versionCount":12,"lastCveUpdate":13,"firstLetter":14,"products":15,"description":18},17711,"libreoffice",1,61,0,471,"2025-04-27","l",[16],{"id":17,"product_name":8,"version_count":12,"cve_count":10,"kev_count":11,"last_cve_update":13},103650,"Libreoffice is a technology vendor with 1 tracked product and 61 known security vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this vendor.",[20,29,37,42,49,54,59,66,71,77],{"cveId":21,"description":22,"publishedDate":23,"cvssScore":24,"cvssVersion":25,"severity":26,"isKev":27,"epssScore":28},"CVE-2018-10583","An information disclosure vulnerability occurs when LibreOffice 6.0.3 and Apache OpenOffice Writer 4.1.5 automatically process and initiate an SMB connection embedded in a malicious file, as demonstrated by xlink:href=file:\u002F\u002F192.168.0.2\u002Ftest.jpg within an office:document-content element in a .odt XML document.","2018-05-01",7.5,"v3.0","High",false,0.78006,{"cveId":30,"description":31,"publishedDate":32,"cvssScore":33,"cvssVersion":34,"severity":35,"isKev":27,"epssScore":36},"CVE-2019-9851","LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is launched from. Protection was added, to address CVE-2019-9848, to block calling LibreLogo from document event script handers, e.g. mouse over. However LibreOffice also has a separate feature where documents can specify that pre-installed scripts can be executed on various global script events such as document-open, etc. In the fixed versions, global script event handlers are validated equivalently to document script event handlers. This issue affects: Document Foundation LibreOffice versions prior to 6.2.6.","2019-08-15",9.8,"v3.1","Critical",0.77837,{"cveId":38,"description":39,"publishedDate":40,"cvssScore":33,"cvssVersion":25,"severity":35,"isKev":27,"epssScore":41},"CVE-2018-16858","It was found that libreoffice before versions 6.0.7 and 6.1.3 was vulnerable to a directory traversal attack which could be used to execute arbitrary macros bundled with a document. An attacker could craft a document, which when opened by LibreOffice, would execute a Python method from a script in any arbitrary file system location, specified relative to the LibreOffice install location.","2019-03-25",0.67321,{"cveId":43,"description":44,"publishedDate":45,"cvssScore":46,"cvssVersion":34,"severity":47,"isKev":27,"epssScore":48},"CVE-2023-1183","A flaw was found in the Libreoffice package. An attacker can craft an odb containing a \"database\u002Fscript\" file with a SCRIPT command where the contents of the file could be written to a new file whose location was determined by the attacker.","2023-07-10",5.5,"Medium",0.64635,{"cveId":50,"description":51,"publishedDate":52,"cvssScore":33,"cvssVersion":34,"severity":35,"isKev":27,"epssScore":53},"CVE-2019-9848","LibreOffice has a feature where documents can specify that pre-installed scripts can be executed on various document events such as mouse-over, etc. LibreOffice is typically also bundled with LibreLogo, a programmable turtle vector graphics script, which can be manipulated into executing arbitrary python commands. By using the document event feature to trigger LibreLogo to execute python contained within a document a malicious document could be constructed which would execute arbitrary python commands silently without warning. In the fixed versions, LibreLogo cannot be called from a document event handler. This issue affects: Document Foundation LibreOffice versions prior to 6.2.5.","2019-07-17",0.2887,{"cveId":55,"description":56,"publishedDate":57,"cvssScore":33,"cvssVersion":25,"severity":35,"isKev":27,"epssScore":58},"CVE-2018-6871","LibreOffice before 5.4.5 and 6.x before 6.0.1 allows remote attackers to read arbitrary files via =WEBSERVICE calls in a document, which use the COM.MICROSOFT.WEBSERVICE function.","2018-02-09",0.22803,{"cveId":60,"description":61,"publishedDate":62,"cvssScore":63,"cvssVersion":64,"severity":35,"isKev":27,"epssScore":65},"CVE-2014-3524","Apache OpenOffice before 4.1.1 allows remote attackers to execute arbitrary commands and possibly have other unspecified impact via a crafted Calc spreadsheet.","2014-08-26",9.3,"v2",0.14533,{"cveId":67,"description":68,"publishedDate":69,"cvssScore":24,"cvssVersion":64,"severity":26,"isKev":27,"epssScore":70},"CVE-2012-1149","Integer overflow in the vclmi.dll module in OpenOffice.org (OOo) 3.3, 3.4 Beta, and possibly earlier, and LibreOffice before 3.5.3, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted embedded image object, as demonstrated by a JPEG image in a .DOC file, which triggers a heap-based buffer overflow.","2012-06-21",0.1417,{"cveId":72,"description":73,"publishedDate":74,"cvssScore":75,"cvssVersion":64,"severity":47,"isKev":27,"epssScore":76},"CVE-2015-4551","LibreOffice before 4.4.5 and Apache OpenOffice before 4.1.2 uses the stored LinkUpdateMode configuration information in OpenDocument Format files and templates when handling links, which might allow remote attackers to obtain sensitive information via a crafted document, which embeds data from local files into (1) Calc or (2) Writer.","2015-11-10",4.3,0.13826,{"cveId":78,"description":79,"publishedDate":80,"cvssScore":81,"cvssVersion":34,"severity":47,"isKev":27,"epssScore":82},"CVE-2012-0037","Redland Raptor (aka libraptor) before 2.0.7, as used by OpenOffice 3.3 and 3.4 Beta, LibreOffice before 3.4.6 and 3.5.x before 3.5.1, and other products, allows user-assisted remote attackers to read arbitrary files via a crafted XML external entity (XXE) declaration and reference in an RDF document.","2012-06-17",6.5,0.13682,[],[85],{"id":17,"product_name":8,"version_count":12,"cve_count":10,"kev_count":11,"last_cve_update":13},{"title":87,"metaDescription":88,"keywords":89,"structuredData":90},"Libreoffice - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Libreoffice covering 1 product with 61 tracked vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Libreoffice vulnerabilities, Libreoffice security, Libreoffice CVE, Libreoffice threat intelligence, vendor security analysis, cybersecurity threats, vulnerability management, CVE tracking",{"@context":91,"@type":92,"name":93,"description":88,"url":94},"https:\u002F\u002Fschema.org","Organization","Libreoffice","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Flibreoffice",{"totalProducts":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":13,"generatedAt":96,"apiVersion":97},"2026-10-19T18:56:56.235Z","3.0"]