Non notée
CVE-2022-26306 LibreOffice supports the storage of passwords for web connections in the user’s configuration database
Description
LibreOffice supports the storage of passwords for web connections in the user’s configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in LibreOffice existed where the required initialization vector for encryption was always the same which weakens the security of the encryption making them vulnerable if an attacker has access to the user's configuration data. This issue affects: The Document Foundation LibreOffice 7.2 versions prior to 7.2.7; 7.3 versions prior to 7.3.1.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| LibreOffice 7.3 | 7.3 → < 7.3.1 | 7.3.1 |
| LibreOffice 7.2 | 7.2 → < 7.2.7 | 7.2.7 |
Références
- www.libreoffice.org www.libreoffice.org
- [oss-security] 20220812 CVE-2022-37400: Apache OpenOffice Static Initialization Vector Allows to Recover Passwords for Web Connections Without Knowing the Master Password www.openwall.com
- [debian-lts-announce] 20230326 [SECURITY] [DLA 3368-1] libreoffice security update lists.debian.org
Chronologie
- Publiée
- Dernière modification
Autres CVE de LibreOffice
Les 48 CVE de LibreOffice →
CVE-2026-76181
Heap buffer overflow in dBASE index import
5.4
Moyenne
CVE-2026-63270
URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information…
6.7
Moyenne
CVE-2026-63269
LibreOffice can link to audio and video files from a document, and on Linux it plays them with GStreamer
6.7
Moyenne
CVE-2026-63267
LibreOffice Calc can link a cell range to an external csv data source, and the link is saved in the document
6.7
Moyenne