Bug 1235383 (CVE-2024-12425) - VUL-0: CVE-2024-12425: libreoffice: path traversal through documents with embedded font files lead to arbitrary .ttf file write
Summary: VUL-0: CVE-2024-12425: libreoffice: path traversal through documents with emb...
Status: RESOLVED FIXED
Alias: CVE-2024-12425
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/435216/
Whiteboard: CVSSv3.1:SUSE:CVE-2024-12425:3.3:(AV:...
Keywords:
Depends on:
Blocks:
 
Reported: 2025-01-07 17:38 UTC by SMASH SMASH
Modified: 2025-03-20 10:30 UTC (History)
1 user (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description SMASH SMASH 2025-01-07 17:38:16 UTC 
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The Document Foundation LibreOffice allows Absolute Path Traversal.

An attacker can write to arbitrary locations, albeit suffixed with ".ttf", by supplying a file in a format that supports embedded font files.

This issue affects LibreOffice: from 24.8 before < 24.8.4.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-12425
https://www.cve.org/CVERecord?id=CVE-2024-12425
https://www.libreoffice.org/about-us/security/advisories/cve-2024-12425
https://github.com/CVEProject/cvelistV5/blob/main//cves/2024/12xxx/CVE-2024-12425.json
https://bugzilla.redhat.com/show_bug.cgi?id=2336110
Comment 2 Martin Schreiner 2025-03-19 20:20:05 UTC 
LibreOffice 24.8.4 is currently being shipped for both SLE12-SP5 and SLE15-SP5, which fixes this issue. We'll be upgrading to 24.8.5 soon.

Factory already has 25.2.

So I think this is already solved, I'm reassigning back to security.