CVE-2023-2255
Title: CVE-2023-2255 Remote documents loaded without prompt via IFrame
Announced: May 24, 2023
Fixed in: LibreOffice 7.4.7/7.5.3
Description:
LibreOffice supports "Floating Frames", similar to a html IFrame. The frames display their linked document in a floating frame inside the host document.
In affected versions of LibreOffice these floating frames fetch and display their linked document without prompt on loading the host document. This was inconsistent with the behavior of other linked document content such as OLE objects, Writer linked sections or Calc WEBSERVICE formulas which warn the user that there are linked documents and prompts if they should be allowed to update.
In versions >= 7.4.7 (and >= 7.5.3) the existing "update link" manager has been expanded to additionally control the update of the content of IFrames, so such IFrames will not automatically refresh their content unless the user agrees via the prompts.
Thanks to Amel Bouziane-Leblond for discovering this flaw.
References:
CVE-2023-2255
Follow Us