MGASA-2026-0514

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2026-0514.html
Import Source
https://advisories.mageia.org/MGASA-2026-0514.json
JSON Data
https://api.osv.dev/v1/vulns/MGASA-2026-0514
Upstream
CVE (13)
  • CVE-2026-63266
  • CVE-2026-63267
  • CVE-2026-63268
  • CVE-2026-63269
  • CVE-2026-63270
  • CVE-2026-63272
  • CVE-2026-63273
  • CVE-2026-63274
  • CVE-2026-63275
  • CVE-2026-63276
  • CVE-2026-63277
  • CVE-2026-63278
  • CVE-2026-63279
Published
2026-10-17T03:21:49Z
Modified
2026-10-17T03:30:03Z
Summary
Updated libreoffice package fixes security vulnerabilities
Details

Arbitrary file write via calcext:data-mappings, sql provider and Firebird backup functionality. (CVE-2026-63266) LFI and GET SSRF via calcext:data-mappings and csv provider. (CVE-2026-63267) LFI via calcext:data-mappings, sql provider and sdbc:flat:file:// db href. (CVE-2026-63268) LFI and GET SSRF via GStreamer and HLS playlists. (CVE-2026-63269) Environment/ini-file leaks. (CVE-2026-63270) Heap buffer overflow in WMF text record import. (CVE-2026-63272) Heap buffer overflow in PDF import encryption handling. (CVE-2026-63273) Heap buffer overflow in PDF import stream handling. (CVE-2026-63274) Stack buffer overflow in CFF font hint handling. (CVE-2026-63275) Stack buffer overflow in CFF to Type 1 font conversion. (CVE-2026-63276) RCE via calcext:data-mappings, sql provider and jdbc connector. (CVE-2026-63277) Package URLs can be used to exfiltrate arbitrary INI file values and environment variables. (CVE-2026-63278) Out of bounds read in PICT image import. (CVE-2026-63279)

References
Credits

Affected packages

Mageia:10 / libreoffice

Package

Name
libreoffice
Purl
pkg:rpm/mageia/libreoffice?arch=source&distro=mageia-10

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
26.2.6.3-1.mga10

Ecosystem specific 

{
    "section":  "core"
}

Database specific

source 
"https://advisories.mageia.org/MGASA-2026-0514.json"