CVE-2022-3140

LibreOffice es compatible con los esquemas URI de Office para permitir la integración del navegador de LibreOffice con el servidor de MS SharePoint. Ha sido añadido un esquema adicional "vnd.libreoffice.command" específico para LibreOffice. En versiones afectadas de LibreOffice los enlaces que usaban ese esquema podían construirse para llamar a macros internas con argumentos arbitrarios. Lo cual, cuando hacía clic en ellos, o eran activados mediante eventos del documento, podía resultar en una ejecución de scripts arbitrarios sin previo aviso. Este problema afecta a: Las versiones de LibreOffice 7.4 de Document Foundation anteriores a 7.4.1; versiones 7.3 anteriores a 7.3.6

A vulnerability was found in LibreOffice that affects the Office URI Schemes. These schemes enable browser integration of LibreOffice with the MS SharePoint server. In LibreOffice, the links using the scheme 'vnd.libreoffice.command' could be constructed to call internal macros with arbitrary arguments, which, when clicked, or activated by document events, could result in arbitrary script execution without warning. The attacker must trick the targeted individual into opening a malicious file to trigger the exploit.

This vulnerability allows remote attackers to execute arbitrary code on affected installations of LibreOffice. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of document files. The issue results from an exposed dangerous function. An attacker can leverage this vulnerability to execute code in the context of the current process.