git: 940cf9711a1e - main - security/vuxml: Document OpenOffice vulnerability CVE-2021-30245

Tue Apr 20 03:52:04 UTC 2021

The branch main has been updated by truckman:

URL: https://cgit.FreeBSD.org/ports/commit/?id=940cf9711a1e9fffe0878f2c9bf916479f170972

commit 940cf9711a1e9fffe0878f2c9bf916479f170972
Author:     Don Lewis <truckman at FreeBSD.org>
AuthorDate: 2021-04-20 03:49:20 +0000
Commit:     Don Lewis <truckman at FreeBSD.org>
CommitDate: 2021-04-20 03:49:20 +0000

    security/vuxml: Document OpenOffice vulnerability CVE-2021-30245
---
 security/vuxml/vuln.xml | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml
index 97c9911ca975..006e614389c2 100644
--- a/security/vuxml/vuln.xml
+++ b/security/vuxml/vuln.xml
@@ -76,6 +76,36 @@ Notes:
   * Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
 -->
 <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
+  <vuln vid="e87c2647-a188-11eb-8806-1c1b0d9ea7e6">
+    <topic>All versions of Apache OpenOffice through 4.1.9 can open non-http(s) hyperlinks. If the link is specifically crafted this could lead to untrusted code execution.</topic>
+    <affects>
+      <package>
+       <name>apache-openoffice</name>
+       <range><lt>4.1.10</lt></range>
+      </package>
+      <package>
+       <name>apache-openoffice-devel</name>
+       <range><lt>4.2.1612022694,4</lt></range>
+      </package>
+    </affects>
+    <description>
+      <body xmlns="http://www.w3.org/1999/xhtml">
+	<p>The Apache Openofffice project reports:</p>
+	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30245">
+	  <p>The project received a report that all versions of Apache OpenOffice through 4.1.8 can open non-http(s) hyperlinks. The problem has existed since about 2006 and the issue is also in 4.1.9. If the link is specifically crafted this could lead to untrusted code execution. It is always best practice to be careful opening documents from unknown and unverified sources. The mitigation in Apache OpenOffice 4.1.10 (unreleased) assures that a security warning is displayed giving the user the option of continuing to open the hyperlink.</p>
+	</blockquote>
+      </body>
+    </description>
+    <references>
+      <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30245</url>
+      <cvename>CVE-2021-30245</cvename>
+    </references>
+    <dates>
+      <discovery>2021-01-25</discovery>
+      <entry>2021-04-20</entry>
+    </dates>
+  </vuln>
+
   <vuln vid="20006b5f-a0bc-11eb-8ae6-fc4dd43e2b6a">
     <topic>Apache Maven -- multiple vulnerabilities</topic>
     <affects>
