This is an automated email from the ASF dual-hosted git repository.
asf-gitbox-commits pushed a commit to branch asf-site
in repository https://gitbox.apache.org/repos/asf/openoffice-org.git
The following commit(s) were added to refs/heads/asf-site by this push:
new 81296920c9 git-site-role commit from copy_staging.sh
81296920c9 is described below
commit 81296920c94b82de80f88158798a6fdade6d4614
Author: jenkins <[email protected]>
AuthorDate: Fri Oct 2 17:53:36 2026 +0000
git-site-role commit from copy_staging.sh
---
content/feed.xml | 4 +--
content/security/bulletin.html | 6 ++++
content/security/cves/CVE-2026-59265.html | 59 +++++++++++++++++++++++++++++++
3 files changed, 67 insertions(+), 2 deletions(-)
diff --git a/content/feed.xml b/content/feed.xml
index fb784a5336..610103503f 100644
--- a/content/feed.xml
+++ b/content/feed.xml
@@ -6,8 +6,8 @@
<atom:link href="http://localhost:8820/feed.xml"; rel="self"
type="application/rss+xml" />
<description>OpenOffice.org Feed</description>
<language>en-us</language>
- <pubDate>Mon, 28 Sep 2026 16:58:55 +0000</pubDate>
- <lastBuildDate>Mon, 28 Sep 2026 16:58:55 +0000</lastBuildDate>
+ <pubDate>Fri, 2 Oct 2026 17:46:32 +0000</pubDate>
+ <lastBuildDate>Fri, 2 Oct 2026 17:46:32 +0000</lastBuildDate>
</channel>
diff --git a/content/security/bulletin.html b/content/security/bulletin.html
index f6a25a9887..d3ea034e06 100644
--- a/content/security/bulletin.html
+++ b/content/security/bulletin.html
@@ -38,6 +38,12 @@
subscribe to our <a href="alerts.html">security-alerts mailing
list</a>.</strong>
</p>
+ <h3>Disclosed in Apache OpenOffice 4.1.16</h3>
+
+ <ul>
+ <li><a href="cves/CVE-2026-59265.html">CVE-2026-59265</a>: Opening a
malicious document can lead to system takeover.</li>
+ </ul>
+
<h3>Fixed in Apache OpenOffice 4.1.16</h3>
<ul>
diff --git a/content/security/cves/CVE-2026-59265.html
b/content/security/cves/CVE-2026-59265.html
new file mode 100644
index 0000000000..c7d4ccc160
--- /dev/null
+++ b/content/security/cves/CVE-2026-59265.html
@@ -0,0 +1,59 @@
+
+<!--#include virtual="/doctype.html" -->
+<html>
+ <head>
+ <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
+
+ <title>CVE-2026-59265</title>
+ <link href="/css/ooo.css" rel="stylesheet" type="text/css">
+
+
+
+ <script src="https://www.apachecon.com/event-images/snippet.js";></script>
+ </head>
+ <body>
+ <!--#include virtual="/brand.html" -->
+ <div id="topbara">
+ <!--#include virtual="/topnav.html" -->
+ <div id="breadcrumbsa"><a href="/">home</a> » <a
href="/security/">security</a> » <a
href="/security/cves/">cves</a></div>
+ </div>
+ <div id="clear"></div>
+
+
+ <div id="content">
+ <p><a
href="https://www.cve.org/CVERecord?id=CVE-2026-59265";>CVE-2026-59265</a></p>
+ <p><a
href="https://www.openoffice.org/security/cves/CVE-2026-59265.html";>Apache
OpenOffice Advisory</a></p>
+ <p style="text-align:center; font-size:largest">Opening a malicious
document can lead to system takeover</p>
+
+
+ <p><strong>Description</strong></p>
+<p>A code execution issue in the Java integration in Apache OpenOffice allows
a crafted untrusted document to trigger the execution of arbitrary, even
remote, code when it is opened by the user.</p>
+<p>This issue affects Apache OpenOffice: through 4.1.16.</p>
+<p>This issue is expected to be fixed in version 4.1.17, which is in the
release candidate phase. Once 4.1.17 is released, users are recommended to
upgrade to that version, which fixes the issue.</p>
+<p>The LibreOffice suite reported this issue as CVE-2026-63277.</p>
+<p><strong>Severity: Critical</strong></p>
+<p>Thanks to the reporters for discovering this issue.</p>
+<p><strong>Vendor: The Apache Software Foundation</strong></p>
+<p><strong>Versions Affected</strong></p>
+<p>All Apache OpenOffice versions 4.1.16 and older are affected.<br />
+OpenOffice.org versions may also be affected.</p>
+<p><strong>Mitigation</strong></p>
+<p>Until 4.1.17 is released, users can mitigate this issue by disabling the
Java runtime integration: choose <em>Tools - Options - OpenOffice - Java</em>
(<em>OpenOffice - Preferences - OpenOffice - Java</em> on macOS) and untick
<em>Use a Java runtime environment</em>. This prevents the attack. If this is
not possible, or as an extra precaution, avoid opening untrusted files
entirely.</p>
+<p>Once released, install Apache OpenOffice 4.1.17 for the latest maintenance
and cumulative security fixes. Use the Apache OpenOffice <a
href="https://www.openoffice.org/download/";>download page</a>.</p>
+<p><strong>Acknowledgements</strong></p>
+<p>The Apache OpenOffice Security Team would like to thank Rick de Jager of
the V12 security team, and Thomas Rinsma and Edoardo Geraci of Codean Labs, who
independently discovered and reported this issue.</p>
+<p><strong>Further Information</strong></p>
+<p>For additional information and assistance, consult the <a
href="https://forum.openoffice.org/";>Apache OpenOffice Community Forums</a> or
make requests to the <a
href="mailto:users@openoffice.apache.org">users@openoffice.apache.org</a>
public mailing list.</p>
+<p>The latest information on Apache OpenOffice security bulletins can be found
at the <a href="https://www.openoffice.org/security/bulletin.html";>Bulletin
Archive</a> page.</p>
+
+
+ <hr />
+ <p>
+ <a href="https://security.openoffice.org";>Security Home</a>->
+ <a
href="https://www.openoffice.org/security/bulletin.html";>Bulletin</a>->
+ <a
href="https://www.openoffice.org/security/cves/CVE-2026-59265.html";>CVE-2026-59265</a>
+ </p>
+ </div>
+ <!--#include virtual="/footer.html" -->
+ </body>
+</html>
