{"id":"MGASA-2026-0514","summary":"Updated libreoffice package fixes security vulnerabilities","details":"Arbitrary file write via calcext:data-mappings, sql provider and\nFirebird backup functionality. (CVE-2026-63266)\nLFI and GET SSRF via calcext:data-mappings and csv provider.\n(CVE-2026-63267)\nLFI via calcext:data-mappings, sql provider and sdbc:flat:file:// db\nhref. (CVE-2026-63268)\nLFI and GET SSRF via GStreamer and HLS playlists. (CVE-2026-63269)\nEnvironment/ini-file leaks. (CVE-2026-63270)\nHeap buffer overflow in WMF text record import. (CVE-2026-63272)\nHeap buffer overflow in PDF import encryption handling. (CVE-2026-63273)\nHeap buffer overflow in PDF import stream handling. (CVE-2026-63274)\nStack buffer overflow in CFF font hint handling. (CVE-2026-63275)\nStack buffer overflow in CFF to Type 1 font conversion. (CVE-2026-63276)\nRCE via calcext:data-mappings, sql provider and jdbc connector.\n(CVE-2026-63277)\nPackage URLs can be used to exfiltrate arbitrary INI file values and\nenvironment variables. (CVE-2026-63278)\nOut of bounds read in PICT image import. (CVE-2026-63279)\n","modified":"2026-10-17T03:30:03.784898295Z","published":"2026-10-17T03:21:49Z","upstream":["CVE-2026-63266","CVE-2026-63267","CVE-2026-63268","CVE-2026-63269","CVE-2026-63270","CVE-2026-63272","CVE-2026-63273","CVE-2026-63274","CVE-2026-63275","CVE-2026-63276","CVE-2026-63277","CVE-2026-63278","CVE-2026-63279"],"references":[{"type":"ADVISORY","url":"https://advisories.mageia.org/MGASA-2026-0514.html"},{"type":"REPORT","url":"https://bugs.mageia.org/show_bug.cgi?id=36383"},{"type":"WEB","url":"https://lists.debian.org/debian-security-announce/2026/msg00424.html"},{"type":"WEB","url":"https://www.libreoffice.org/security/#cve-2026-63272"},{"type":"WEB","url":"https://www.libreoffice.org/security/#cve-2026-63273"},{"type":"WEB","url":"https://www.libreoffice.org/security/#cve-2026-63274"},{"type":"WEB","url":"https://www.libreoffice.org/security/#cve-2026-63275"},{"type":"WEB","url":"https://www.libreoffice.org/security/#cve-2026-63276"},{"type":"WEB","url":"https://www.libreoffice.org/security/#cve-2026-63277"},{"type":"WEB","url":"https://www.libreoffice.org/security/#cve-2026-63278"},{"type":"WEB","url":"https://www.libreoffice.org/security/#cve-2026-63279"},{"type":"WEB","url":"https://lists.debian.org/debian-security-announce/2026/msg00457.html"},{"type":"WEB","url":"https://www.libreoffice.org/security/#cve-2026-63266"},{"type":"WEB","url":"https://www.libreoffice.org/security/#cve-2026-63267"},{"type":"WEB","url":"https://www.libreoffice.org/security/#cve-2026-63268"},{"type":"WEB","url":"https://www.libreoffice.org/security/#cve-2026-63269"},{"type":"WEB","url":"https://www.libreoffice.org/security/#cve-2026-63270"},{"type":"ADVISORY","url":"https://ubuntu.com/security/notices/USN-8868-1"}],"affected":[{"package":{"name":"libreoffice","ecosystem":"Mageia:10","purl":"pkg:rpm/mageia/libreoffice?arch=source&distro=mageia-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.2.6.3-1.mga10"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2026-0514.json"}}],"schema_version":"1.9.0","credits":[{"name":"Mageia","contact":["https://wiki.mageia.org/en/Packages_Security_Team"],"type":"COORDINATOR"}]}