PT-2015-2736 · Document Foundation+5 · Libreoffice+6

Published 2015-10-10 · Updated 2024-06-15 · CVE-2015-5212

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions LibreOffice versions prior to 4.4.5 Apache OpenOffice versions prior to 4.1.2

Description The issue is related to an integer underflow that occurs when the configuration setting "Load printer settings with the document" is enabled. This allows remote attackers to cause a denial of service, resulting in memory corruption and application crash, or possibly execute arbitrary code via crafted PrinterSetup data in an ODF document.

Recommendations For LibreOffice versions prior to 4.4.5, update to version 4.4.5 or later to resolve the issue. For Apache OpenOffice versions prior to 4.1.2, update to version 4.1.2 or later to resolve the issue. As a temporary workaround, consider disabling the "Load printer settings with the document" configuration setting until a patch is available.

Fix

DoS

Integer Underflow

Weakness Enumeration

CWE-189

CWE-191

Related Identifiers

BDU:2015-12101

CESA-2015_2619

CVE-2015-5212

DSA-3394-1

MGASA-2015-0441

OPENSUSE-SU-2024:10006-1

RHSA-2015:2619

RHSA-2015_2619

SUSE-SU-2015:1915-1

SUSE-SU-2016:0324-1

USN-2793-1

Affected Products

Apache Openoffice

Centos

Libreoffice

Openoffice

Red Hat

Suse

Ubuntu

References · 130

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5214 · Security Note
• http://rhn.redhat.com/errata/RHSA-2015-2619.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-5212 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2015-5212 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10006-1 · Vendor Advisory
• http://openoffice.org/security/cves/CVE-2015-5212.html · Vendor Advisory
• https://security.gentoo.org/glsa/201611-03 · Vendor Advisory
• http://debian.org/security/2015/dsa-3394 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se15-bulletin-20201201SE15 · Vendor Advisory
• http://libreoffice.org/about-us/security/advisories/cve-2015-5212 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-5212 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-12102 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5213 · Security Note
• https://osv.dev/vulnerability/USN-2793-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2015-5212 · Vendor Advisory