PT-2015-2733 · Document Foundation+5 · Libreoffice+6

Federico Scrinzi · Published 2015-10-10 · Updated 2024-06-15 · CVE-2015-4551

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions LibreOffice versions prior to 4.4.5 Apache OpenOffice versions prior to 4.1.2

Description The issue allows remote attackers to obtain sensitive information via a crafted document, which embeds data from local files into Calc or Writer. This is due to the use of stored LinkUpdateMode configuration information in OpenDocument Format files and templates when handling links.

Recommendations For LibreOffice versions prior to 4.4.5, update to version 4.4.5 or later. For Apache OpenOffice versions prior to 4.1.2, update to version 4.1.2 or later. As a temporary workaround, consider restricting the use of the LinkUpdateMode configuration to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2015-12098

CESA-2015_2619

CVE-2015-4551

DSA-3394-1

MGASA-2015-0441

OPENSUSE-SU-2024:10006-1

RHSA-2015:2619

RHSA-2015_2619

SUSE-SU-2015:1915-1

SUSE-SU-2016:0324-1

USN-2793-1

Affected Products

Apache Openoffice

Centos

Libreoffice

Openoffice

Red Hat

Suse

Ubuntu

References · 130

• http://rhn.redhat.com/errata/RHSA-2015-2619.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-4551 · Security Note
• https://security.gentoo.org/glsa/201611-03 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-12102 · Security Note
• http://debian.org/security/2015/dsa-3394 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2015-4551 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-4551 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-4551 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-5214 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2015-4551 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4551 · Security Note
• http://openoffice.org/security/cves/CVE-2015-4551.html · Vendor Advisory
• http://ubuntu.com/usn/USN-2793-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-12098 · Security Note
• https://security-tracker.debian.org/tracker/DSA-3394-1 · Vendor Advisory