p PatchFirst

RLSA-2026:88164

RLSA-2026:88164 · Important: flute, libbase, libfonts, libformula, liblayout, libloader, libreoffice, librepository, libserializer, pentaho-libxml, pentaho-reporting-flow-engine, and sac security, bug fix, and enhancement update

This page contains facts from public vulnerability sources. Check the original advisory before updating.

SAC is a standard interface for CSS parsers, intended to work with CSS1, CSS2, CSS3 and other CSS derived languages. Security Fix(es): * libreoffice: heap buffer overflow in PDF import stream handling (CVE-2026-63274) * libreoffice: stack buffer overflow in CFF to Type 1 font conversion (CVE-2026-63276) * libreoffice: stack buffer overflow in CFF font hint handling (CVE-2026-63275) * libreoffice: libreoffice: Arbitrary code execution via remote Java database driver (CVE-2026-63277) Bug Fix(es) and Enhancement(s): * [libbase] LibreOffice packages using EOL Java (after November 2026) (JIRA:Rocky Linux-275415) * [flute] LibreOffice packages using EOL Java (after November 2026) (JIRA:Rocky Linux-275416) * [libserializer] LibreOffice packages using EOL Java (after November 2026) (JIRA:Rocky Linux-275417) * [libloader] LibreOffice packages using EOL Java (after November 2026) (JIRA:Rocky Linux-275418) * [libformula] LibreOffice packages using EOL Java (after November 2026) (JIRA:Rocky Linux-275419) * [librepository] LibreOffice packages using EOL Java (after November 2026) (JIRA:Rocky Linux-275420) * [libfonts] LibreOffice packages using EOL Java (after November 2026) (JIRA:Rocky Linux-275421) * [liblayout] LibreOffice packages using EOL Java (after November 2026) (JIRA:Rocky Linux-275422) * [pentaho-libxml] LibreOffice packages using EOL Java (after November 2026) (JIRA:Rocky Linux-275423) * [pentaho-reporting-flow-engine] LibreOffice packages using EOL Java (after November 2026) (JIRA:Rocky Linux-275424) * [sac] LibreOffice packages using EOL Java (after November 2026) (JIRA:Rocky Linux-277813) * [libreoffice] LibreOffice packages using EOL Java (after November 2026) (JIRA:Rocky Linux-260518) * [Rocky Linux 8.10] Base Report Wizard fails with packaged Pentaho reporting engine (JIRA:Rocky Linux-286491) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

CVSS 7.8 · High · Fix available

Published
Updated

Stack: system

Affected products and versions

  • flute Rocky Linux:8

    Affected ranges
    • ECOSYSTEM: < 0:1.3.0-19.OOo31.el8_10

    Update to 0:1.3.0-19.OOo31.el8_10

  • libbase Rocky Linux:8

    Affected ranges
    • ECOSYSTEM: < 0:1.1.3-21.el8_10

    Update to 0:1.1.3-21.el8_10

  • libfonts Rocky Linux:8

    Affected ranges
    • ECOSYSTEM: < 0:1.1.3-23.el8_10

    Update to 0:1.1.3-23.el8_10

  • libformula Rocky Linux:8

    Affected ranges
    • ECOSYSTEM: < 0:1.1.3-20.el8_10

    Update to 0:1.1.3-20.el8_10

  • liblayout Rocky Linux:8

    Affected ranges
    • ECOSYSTEM: < 0:0.2.10-19.el8_10

    Update to 0:0.2.10-19.el8_10

  • libloader Rocky Linux:8

    Affected ranges
    • ECOSYSTEM: < 0:1.1.3-19.el8_10

    Update to 0:1.1.3-19.el8_10

  • libreoffice Rocky Linux:8

    Affected ranges
    • ECOSYSTEM: < 1:7.1.8.1-3.el8_10

    Update to 1:7.1.8.1-3.el8_10

  • librepository Rocky Linux:8

    Affected ranges
    • ECOSYSTEM: < 0:1.1.3-19.el8_10

    Update to 0:1.1.3-19.el8_10

  • libserializer Rocky Linux:8

    Affected ranges
    • ECOSYSTEM: < 0:1.1.2-20.el8_10

    Update to 0:1.1.2-20.el8_10

  • pentaho-libxml Rocky Linux:8

    Affected ranges
    • ECOSYSTEM: < 0:1.1.3-20.el8_10

    Update to 0:1.1.3-20.el8_10

  • pentaho-reporting-flow-engine Rocky Linux:8

    Affected ranges
    • ECOSYSTEM: < 1:0.9.4-17.el8_10

    Update to 1:0.9.4-17.el8_10

Original sources

Check your server →