Apache OpenOffice < 4.1.17 Multiple Vulnerabilities (macOS)

high Nessus Plugin ID 371066

Synopsis

The remote macOS host has an application installed that is affected by multiple vulnerabilities.

Description

The version of Apache OpenOffice installed on the remote host is prior to 4.1.17. It is, therefore, affected by multiple vulnerabilities:

- A code execution issue in the Java integration in Apache OpenOffice v4.1.16 and earlier allows a crafted untrusted document to trigger executing arbitrary (even remote) code when opened by the user. (CVE-2026-59265)

- Calc can link a cell range to an external data source, and the link is saved in the document. A document could name a Java database driver for such a link to be loaded from a remote location, so opening the document could run Java code from that location. In fixed versions an entry in a Java class path has to be a file URL. The Apache OpenOffice advisory records that the LibreOffice suite reported this same issue as CVE-2026-63277. (CVE-2026-63277)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to Apache OpenOffice version 4.1.17 or later.

Plugin Details

Severity: High

ID: 371066

File Name: macos_openoffice_4117.nasl

Version: 1.2

Type: Local

Agent: macosx

Family: MacOS X Local Security Checks

Published: 10/23/2026

Updated: 10/23/2026

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.6

Percentile: 98.2

CVSS v2

Risk Factor: Critical

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-59265

CVSS v3

Risk Factor: High

Base Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Vulnerability Information

CPE: cpe:/a:apache:openoffice

Required KB Items: installed_sw/OpenOffice

Patch Publication Date: 10/14/2026

Vulnerability Publication Date: 10/2/2026

Reference Information

CVE: CVE-2026-59265, CVE-2026-63277

IAVA: 2026-A-1145

Detections

Analytics