सुरक्षा सलाह पर वापस जाएँ
Flute, Libbase, Libfonts, Libformula, Liblayout, Libloader, Libreoffice, Librepository, Libserializer, Pentaho-Libxml, Pentaho-Reporting-Flow-Engine, And Sac Security Update — AlmaLinux 8 (ALSA-2026:88164)
ALSA-2026:88164 updates the LibreOffice and Pentaho reporting library packages on AlmaLinux 8, fixing four flaws led by a heap buffer overflow in LibreOffice's PDF import stream handling (CVE-2026-63274) and stack buffer overflows in CFF-to-Type-1 font conversion (CVE-2026-63276) and CFF font hint handling (CVE-2026-63275), plus an arbitrary-code-execution flaw (CVE-2026-63277). Update the package set with dnf update on servers that process documents headlessly.
High
5.4 CVSS
AlmaLinux 8
SharedLicense लाइसेंस के तहत इसका अर्थ
Document-parsing flaws are triggered by opening a crafted file: on servers running headless LibreOffice conversions (the common automation pattern), a malicious uploaded document becomes remote code execution in the conversion worker.
SAC is a standard interface for CSS parsers, intended to work with CSS1, CSS2, CSS3 and other CSS derived languages. Security Fix(es): * libreoffice: heap buffer overflow in PDF import stream handling (CVE-2026-63274) * libreoffice: stack buffer overflow in CFF to Type 1 font conversion (CVE-2026-63276) * libreoffice: stack buffer overflow in CFF font hint handling (CVE-2026-63275) * libreoffice: libreoffice: Arbitrary code execution via remote Java database driver (CVE-2026-63277) Bug Fix(es) and Enhancement(s): * [libbase] LibreOffice packages using EOL Java (after November 2026) (JIRA:AlmaLinux-275415) * [flute] LibreOffice packages using EOL Java (after November 2026) (JIRA:AlmaLinux-275416) * [libserializer] LibreOffice packages using EOL Java (after November 2026) (JIRA:AlmaLinux-275417) * [libloader] LibreOffice packages using EOL Java (after November 2026) (JIRA:AlmaLinux-275418) * [libformula] LibreOffice packages using EOL Java (after November 2026) (JIRA:AlmaLinux-275419) * [librepository] LibreOffice packages using EOL Java (after November 2026) (JIRA:AlmaLinux-275420) * [libfonts] LibreOffice packages using EOL Java (after November 2026) (JIRA:AlmaLinux-275421) * [liblayout] LibreOffice packages using EOL Java (after November 2026) (JIRA:AlmaLinux-275422) * [pentaho-libxml] LibreOffice packages using EOL Java (after November 2026) (JIRA:AlmaLinux-275423) * [pentaho-reporting-flow-engine] LibreOffice packages using EOL Java (after November 2026) (JIRA:AlmaLinux-275424) * [sac] LibreOffice packages using EOL Java (after November 2026) (JIRA:AlmaLinux-277813) * [libreoffice] LibreOffice packages using EOL Java (after November 2026) (JIRA:AlmaLinux-260518) * [AlmaLinux 8.10] Base Report Wizard fails with packaged Pentaho reporting engine (JIRA:AlmaLinux-286491) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
अक्सर पूछे जाने वाले प्रश्न
What does ALSA-2026:88164 fix?
Four LibreOffice-related vulnerabilities across the Flute, Libbase, Libfonts, Libformula, Liblayout, Libloader, Libreoffice, Librepository, Libserializer, Pentaho-libxml and Pentaho-reporting-flow-engine packages: a heap buffer overflow in PDF import stream handling (CVE-2026-63274), stack buffer overflows in CFF to Type-1 font conversion (CVE-2026-63276) and CFF font hint handling (CVE-2026-63275), and an arbitrary code execution flaw (CVE-2026-63277). Aggregate CVSS 5.4, out-of-bounds read class (CWE-125) also present.
Who is affected?
AlmaLinux 8 servers with LibreOffice or the Pentaho reporting libraries installed — most commonly headless document-conversion workers. Desktop conversion of untrusted files is the same risk.
How do I apply the fix?
Run dnf update 'libreoffice*' along with the other listed packages (or a general dnf update) and restart any long-running conversion services so they load the patched libraries.
Why does a font-conversion bug matter for servers?
CFF font and PDF import code parses attacker-controlled data inside documents — crafted fonts or embedded PDFs are the delivery channel, and memory-corruption flaws there are a classic document-to-RCE path on automation workers.
संदर्भ
अपने सिस्टम में भेद्यताओं की जाँच करें
अपना उत्पाद और ऑपरेटिंग सिस्टम चुनें ताकि आपके लिए लागू सटीक फिक्स कमांड देख सकें।
अपना सिस्टम जाँचें