RLSA-2026:88164

See a problem?
Please try reporting it to the source first.
Source
https://errata.rockylinux.org/RLSA-2026:88164
Import Source
https://storage.googleapis.com/resf-osv-data/RLSA-2026:88164.json
JSON Data
https://api.osv.dev/v1/vulns/RLSA-2026:88164
Upstream
CVE (4)
  • CVE-2026-63274
  • CVE-2026-63275
  • CVE-2026-63276
  • CVE-2026-63277
Published
2026-10-23T06:42:37Z
Modified
2026-10-23T07:15:03Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Important: flute, libbase, libfonts, libformula, liblayout, libloader, libreoffice, librepository, libserializer, pentaho-libxml, pentaho-reporting-flow-engine, and sac security, bug fix, and enhancement update
Details

SAC is a standard interface for CSS parsers, intended to work with CSS1, CSS2, CSS3 and other CSS derived languages.

Security Fix(es):

  • libreoffice: heap buffer overflow in PDF import stream handling (CVE-2026-63274)

  • libreoffice: stack buffer overflow in CFF to Type 1 font conversion (CVE-2026-63276)

  • libreoffice: stack buffer overflow in CFF font hint handling (CVE-2026-63275)

  • libreoffice: libreoffice: Arbitrary code execution via remote Java database driver (CVE-2026-63277)

Bug Fix(es) and Enhancement(s):

  • [libbase] LibreOffice packages using EOL Java (after November 2026) (JIRA:Rocky Linux-275415)

  • [flute] LibreOffice packages using EOL Java (after November 2026) (JIRA:Rocky Linux-275416)

  • [libserializer] LibreOffice packages using EOL Java (after November 2026) (JIRA:Rocky Linux-275417)

  • [libloader] LibreOffice packages using EOL Java (after November 2026) (JIRA:Rocky Linux-275418)

  • [libformula] LibreOffice packages using EOL Java (after November 2026) (JIRA:Rocky Linux-275419)

  • [librepository] LibreOffice packages using EOL Java (after November 2026) (JIRA:Rocky Linux-275420)

  • [libfonts] LibreOffice packages using EOL Java (after November 2026) (JIRA:Rocky Linux-275421)

  • [liblayout] LibreOffice packages using EOL Java (after November 2026) (JIRA:Rocky Linux-275422)

  • [pentaho-libxml] LibreOffice packages using EOL Java (after November 2026) (JIRA:Rocky Linux-275423)

  • [pentaho-reporting-flow-engine] LibreOffice packages using EOL Java (after November 2026) (JIRA:Rocky Linux-275424)

  • [sac] LibreOffice packages using EOL Java (after November 2026) (JIRA:Rocky Linux-277813)

  • [libreoffice] LibreOffice packages using EOL Java (after November 2026) (JIRA:Rocky Linux-260518)

  • [Rocky Linux 8.10] Base Report Wizard fails with packaged Pentaho reporting engine (JIRA:Rocky Linux-286491)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Database specific 
{
    "license":  "CC-BY-4.0",
    "license_url":  "https://creativecommons.org/licenses/by/4.0/",
    "source_advisory":  "RHSA-2026:88164"
}
References
Credits
    • Rocky Enterprise Software Foundation
    • Red Hat

Affected packages

Rocky Linux:8
flute

Package

Name
flute
Purl
pkg:rpm/rocky-linux/flute?distro=rocky-linux-8&epoch=0

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0:1.3.0-19.OOo31.el8_10
Database specific
Show details 
{
    "yum_repository":  "AppStream"
}

Database specific

source 
"https://storage.googleapis.com/resf-osv-data/RLSA-2026:88164.json"
libbase

Package

Name
libbase
Purl
pkg:rpm/rocky-linux/libbase?distro=rocky-linux-8&epoch=0

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0:1.1.3-21.el8_10
Database specific
Show details 
{
    "yum_repository":  "AppStream"
}

Database specific

source 
"https://storage.googleapis.com/resf-osv-data/RLSA-2026:88164.json"
libfonts

Package

Name
libfonts
Purl
pkg:rpm/rocky-linux/libfonts?distro=rocky-linux-8&epoch=0

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0:1.1.3-23.el8_10
Database specific
Show details 
{
    "yum_repository":  "AppStream"
}

Database specific

source 
"https://storage.googleapis.com/resf-osv-data/RLSA-2026:88164.json"
libformula

Package

Name
libformula
Purl
pkg:rpm/rocky-linux/libformula?distro=rocky-linux-8&epoch=0

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0:1.1.3-20.el8_10
Database specific
Show details 
{
    "yum_repository":  "AppStream"
}

Database specific

source 
"https://storage.googleapis.com/resf-osv-data/RLSA-2026:88164.json"
liblayout

Package

Name
liblayout
Purl
pkg:rpm/rocky-linux/liblayout?distro=rocky-linux-8&epoch=0

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0:0.2.10-19.el8_10
Database specific
Show details 
{
    "yum_repository":  "AppStream"
}

Database specific

source 
"https://storage.googleapis.com/resf-osv-data/RLSA-2026:88164.json"
libloader

Package

Name
libloader
Purl
pkg:rpm/rocky-linux/libloader?distro=rocky-linux-8&epoch=0

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0:1.1.3-19.el8_10
Database specific
Show details 
{
    "yum_repository":  "AppStream"
}

Database specific

source 
"https://storage.googleapis.com/resf-osv-data/RLSA-2026:88164.json"
libreoffice

Package

Name
libreoffice
Purl
pkg:rpm/rocky-linux/libreoffice?distro=rocky-linux-8&epoch=1

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1:7.1.8.1-3.el8_10
Database specific
Show details 
{
    "yum_repository":  "AppStream"
}

Database specific

source 
"https://storage.googleapis.com/resf-osv-data/RLSA-2026:88164.json"
librepository

Package

Name
librepository
Purl
pkg:rpm/rocky-linux/librepository?distro=rocky-linux-8&epoch=0

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0:1.1.3-19.el8_10
Database specific
Show details 
{
    "yum_repository":  "AppStream"
}

Database specific

source 
"https://storage.googleapis.com/resf-osv-data/RLSA-2026:88164.json"
libserializer

Package

Name
libserializer
Purl
pkg:rpm/rocky-linux/libserializer?distro=rocky-linux-8&epoch=0

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0:1.1.2-20.el8_10
Database specific
Show details 
{
    "yum_repository":  "AppStream"
}

Database specific

source 
"https://storage.googleapis.com/resf-osv-data/RLSA-2026:88164.json"
pentaho-libxml

Package

Name
pentaho-libxml
Purl
pkg:rpm/rocky-linux/pentaho-libxml?distro=rocky-linux-8&epoch=0

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0:1.1.3-20.el8_10
Database specific
Show details 
{
    "yum_repository":  "AppStream"
}

Database specific

source 
"https://storage.googleapis.com/resf-osv-data/RLSA-2026:88164.json"
pentaho-reporting-flow-engine

Package

Name
pentaho-reporting-flow-engine
Purl
pkg:rpm/rocky-linux/pentaho-reporting-flow-engine?distro=rocky-linux-8&epoch=1

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1:0.9.4-17.el8_10
Database specific
Show details 
{
    "yum_repository":  "AppStream"
}

Database specific

source 
"https://storage.googleapis.com/resf-osv-data/RLSA-2026:88164.json"