[Git][security-tracker-team/security-tracker][master] new libreoffice issues

[Moritz Muehlenhoff (@jmm)]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
8cd87449 by Moritz Muehlenhoff at 2026-10-05T11:49:15+02:00
new libreoffice issues

- - - - -


2 changed files:

- data/CVE/list
- data/dsa-needed.txt


Changes:

=====================================
data/CVE/list
=====================================
@@ -1,3 +1,21 @@
+CVE-2026-63266 [Arbitrary file write via calcext:data-mappings, sql provider and Firebird backup functionality]
+	- libreoffice 4:26.2.5.2-1
+	NOTE: https://www.libreoffice.org/security/#cve-2026-63266
+CVE-2026-63267 [LFI and GET SSRF via calcext:data-mappings and csv provider]
+	- libreoffice 4:26.2.5.2-1
+	NOTE: https://www.libreoffice.org/security/#cve-2026-63267
+CVE-2026-63268 [LFI via calcext:data-mappings, sql provider and sdbc:flat:file:// db href]
+	- libreoffice 4:26.2.5.2-1
+	NOTE: https://www.libreoffice.org/security/#cve-2026-63268
+CVE-2026-63269 [LFI and GET SSRF via GStreamer and HLS playlists]
+	- libreoffice 4:26.2.5.2-1
+	NOTE: https://www.libreoffice.org/security/#cve-2026-63269
+CVE-2026-63270 [Environment/ini-file leaks]
+	- libreoffice 4:26.2.5.2-1
+	NOTE: https://www.libreoffice.org/security/#cve-2026-63270
+CVE-2026-63277 [RCE via calcext:data-mappings, sql provider and jdbc connector]
+	- libreoffice 4:26.2.5.2-1
+	NOTE: https://www.libreoffice.org/security/#cve-2026-63271
 CVE-2026-84169 (The UPI QR Code Payment Gateway WordPress plugin through 1.4.3 does no ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-78371 (The File Uploads Addon for WooCommerce WordPress plugin before 1.7.6 d ...)


=====================================
data/dsa-needed.txt
=====================================
@@ -80,6 +80,8 @@ kitty
 --
 libnet-idn-encode-perl (carnil)
 --
+libreoffice (jmm)
+--
 linux (carnil)
   Wait until more issues have piled up, though try to regulary rebase for point
   releases to more 6.12.y versions



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/8cd8744940a739da78b37352b5bce5b4c983d0b0

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/8cd8744940a739da78b37352b5bce5b4c983d0b0
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261005/7e9b4619/attachment.htm>