CVE-2022-38745

A flaw was found in LibreOffice. When an empty Java class path entry is configured, LibreOffice will search for Java classes in the current working directory, allowing malicious Java classes to load when opening a document using the file manager, resulting in arbitrary code execution.

To exploit this flaw, an attacker would need to convince a user to extract an archive (tar, zip, etc) containing a LibreOffice document and a specific file with Java code inside it, and then the user would need to open the LibreOffice document normally. As user interaction is required to open an unstrusted file, this flaw was rated with a moderate security impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Disabling the Java runtime in LibreOffice will mitigate this issue. To disable it, uncheck the "Use a Java runtime environment" option box via: Tools, Options, LibreOffice/Advanced, Use a Java runtime environment.