CVE-2024-3044 Graphic on-click binding allows unchecked script execution
Attackers can execute arbitrary scripts via malicious documents by exploiting unchecked script execution in graphic on-click bindings.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-3044?
CVE-2024-3044 is a medium-severity code injection vulnerability in Debian Debian Linux, published on 14 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Unchecked script execution in Graphic on-click binding in affected LibreOffice versions allows an attacker to create a document which without prompt will execute scripts built-into LibreOffice on clicking a graphic. Such scripts were previously deemed trusted but are now deemed untrusted.
Which versions are affected by CVE-2024-3044?
It affects 3 products.
Linux distribution packages (40)
autocorr-af AlmaLinux:8 | All versions | 1:6.4.7.2-17.el8_10.alma.1 |
autocorr-bg AlmaLinux:8 | All versions | 1:6.4.7.2-17.el8_10.alma.1 |
autocorr-ca AlmaLinux:8 | All versions | 1:6.4.7.2-17.el8_10.alma.1 |
autocorr-cs AlmaLinux:8 | All versions | 1:6.4.7.2-17.el8_10.alma.1 |
autocorr-da AlmaLinux:8 | All versions | 1:6.4.7.2-17.el8_10.alma.1 |
autocorr-de AlmaLinux:8 | All versions | 1:6.4.7.2-17.el8_10.alma.1 |
autocorr-en AlmaLinux:8 | All versions | 1:6.4.7.2-17.el8_10.alma.1 |
autocorr-es AlmaLinux:8 | All versions | 1:6.4.7.2-17.el8_10.alma.1 |
autocorr-fa AlmaLinux:8 | All versions | 1:6.4.7.2-17.el8_10.alma.1 |
autocorr-fi AlmaLinux:8 | All versions | 1:6.4.7.2-17.el8_10.alma.1 |
autocorr-fr AlmaLinux:8 | All versions | 1:6.4.7.2-17.el8_10.alma.1 |
autocorr-ga AlmaLinux:8 | All versions | 1:6.4.7.2-17.el8_10.alma.1 |
autocorr-hr AlmaLinux:8 | All versions | 1:6.4.7.2-17.el8_10.alma.1 |
autocorr-hu AlmaLinux:8 | All versions | 1:6.4.7.2-17.el8_10.alma.1 |
autocorr-is AlmaLinux:8 | All versions | 1:6.4.7.2-17.el8_10.alma.1 |
autocorr-it AlmaLinux:8 | All versions | 1:6.4.7.2-17.el8_10.alma.1 |
autocorr-ja AlmaLinux:8 | All versions | 1:6.4.7.2-17.el8_10.alma.1 |
autocorr-ko AlmaLinux:8 | All versions | 1:6.4.7.2-17.el8_10.alma.1 |
autocorr-lb AlmaLinux:8 | All versions | 1:6.4.7.2-17.el8_10.alma.1 |
autocorr-lt AlmaLinux:8 | All versions | 1:6.4.7.2-17.el8_10.alma.1 |
autocorr-mn AlmaLinux:8 | All versions | 1:6.4.7.2-17.el8_10.alma.1 |
autocorr-nl AlmaLinux:8 | All versions | 1:6.4.7.2-17.el8_10.alma.1 |
autocorr-pl AlmaLinux:8 | All versions | 1:6.4.7.2-17.el8_10.alma.1 |
autocorr-pt AlmaLinux:8 | All versions | 1:6.4.7.2-17.el8_10.alma.1 |
autocorr-ro AlmaLinux:8 | All versions | 1:6.4.7.2-17.el8_10.alma.1 |
autocorr-ru AlmaLinux:8 | All versions | 1:6.4.7.2-17.el8_10.alma.1 |
autocorr-sk AlmaLinux:8 | All versions | 1:6.4.7.2-17.el8_10.alma.1 |
autocorr-sl AlmaLinux:8 | All versions | 1:6.4.7.2-17.el8_10.alma.1 |
autocorr-sr AlmaLinux:8 | All versions | 1:6.4.7.2-17.el8_10.alma.1 |
autocorr-sv AlmaLinux:8 | All versions | 1:6.4.7.2-17.el8_10.alma.1 |
autocorr-tr AlmaLinux:8 | All versions | 1:6.4.7.2-17.el8_10.alma.1 |
autocorr-vi AlmaLinux:8 | All versions | 1:6.4.7.2-17.el8_10.alma.1 |
autocorr-zh AlmaLinux:8 | All versions | 1:6.4.7.2-17.el8_10.alma.1 |
libreoffice AlmaLinux:8 | All versions | 1:6.4.7.2-17.el8_10.alma.1 |
libreoffice-base AlmaLinux:8 | All versions | 1:6.4.7.2-17.el8_10.alma.1 |
libreoffice-calc AlmaLinux:8 | All versions | 1:6.4.7.2-17.el8_10.alma.1 |
libreoffice-core AlmaLinux:8 | All versions | 1:6.4.7.2-17.el8_10.alma.1 |
libreoffice-data AlmaLinux:8 | All versions | 1:6.4.7.2-17.el8_10.alma.1 |
libreoffice-draw AlmaLinux:8 | All versions | 1:6.4.7.2-17.el8_10.alma.1 |
libreoffice-emailmerge AlmaLinux:8 | All versions | 1:6.4.7.2-17.el8_10.alma.1 |
Products include Debian Debian Linux, Fedoraproject Fedora, Libreoffice Libreoffice.
How do I fix CVE-2024-3044?
Apply the vendor's patch.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2024-3044 being exploited?
There is no known exploitation of CVE-2024-3044 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALSA-2024:4242, ALSA-2024:4755, BELL-CVE-2024-3044, DEBIAN-CVE-2024-3044, DLA-3821-1, DSA-5690-1 and 9 more.