CVE-2024-12425 — Path traversal leading to arbitrary .ttf file write

CVE-2024-12425

Path traversal leading to arbitrary .ttf file write PUBLISHED

Description (CNA)

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The Document Foundation LibreOffice allows Absolute Path Traversal. An attacker can write to arbitrary locations, albeit suffixed with ".ttf", by supplying a file in a format that supports embedded font files. This issue affects LibreOffice: from 24.8 before < 24.8.4.

Affected (CNA)

Vendor / product	Versions
The Document Foundation / LibreOffice	affected 24.8 before < 24.8.4

CWE

CWE-22

References

https://www.libreoffice.org/about-us/security/advisories/cve-2024-12425

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.

https://lists.debian.org/debian-lts-announce/2025/01/msg00013.html