LibreOffice Path Traversal Vulnerability Allowing Arbitrary .ttf File Write

A path traversal vulnerability has been identified in LibreOffice versions 24.8 prior to 24.8.4, allowing for absolute path traversal. This vulnerability enables an attacker to write to arbitrary locations, provided the locations are accessible for writing, by embedding a file in a format that supports embedded fonts. The written files are always suffixed with '.ttf'.

Impact

Exploitation of this vulnerability could lead to unauthorized writing of files with a '.ttf' extension to locations accessible by the user.

Remediation

Users are advised to upgrade to LibreOffice version 24.8.4 to address this vulnerability.