Not rated
CVE-2021-30245 The project received a report that all versions of Apache OpenOffice through 4.1.8 can open non-http(s) hyperlinks
Description
The project received a report that all versions of Apache OpenOffice through 4.1.8 can open non-http(s) hyperlinks. The problem has existed since about 2006 and the issue is also in 4.1.9. If the link is specifically crafted this could lead to untrusted code execution. It is always best practice to be careful opening documents from unknown and unverified sources. The mitigation in Apache OpenOffice 4.1.10 (unreleased) assures that a security warning is displayed giving the user the option of continuing to open the hyperlink.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache OpenOffice 4.1 | earliest → 4.1.9 | No fix stated |
References
- lists.apache.org lists.apache.org
- [openoffice-dev] 20210415 CVE-2021-30245: Code execution in Apache OpenOffice via non-http(s) schemes in Hyperlinks lists.apache.org
- [openoffice-dev] 20210415 Re: CVE-2021-30245: Code execution in Apache OpenOffice via non-http(s) schemes in Hyperlinks lists.apache.org
- [openoffice-users] 20210415 Re: CVE-2021-30245: Code execution in Apache OpenOffice via non-http(s) schemes in Hyperlinks lists.apache.org
- [announce] 20210415 CVE-2021-30245: Code execution in Apache OpenOffice via non-http(s) schemes in Hyperlinks lists.apache.org
Timeline
- Published
- Last modified
Other CVEs of Apache OpenOffice
The 39 CVEs of Apache OpenOffice →
CVE-2026-59267
Apache OpenOffice: Heap Buffer Overflow in DXF LWPOLYLINE import could cause memory corruption
5.8
Medium
CVE-2026-90632
Apache OpenOffice: Local file inclusion via GStreamer plugin
Not rated
CVE-2026-90634
Apache OpenOffice: Out-of-bounds write when importing encrypted PDF files
Not rated
CVE-2026-90631
Apache OpenOffice: Remote document loaded without prompt, possibiy leaking environment variables
Not rated