PT-2015-2738 · Document Foundation+5 · Libreoffice+6

Published 2015-10-10 · Updated 2024-06-15 · CVE-2015-5214

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions LibreOffice versions prior to 4.4.6 LibreOffice 5.x versions prior to 5.0.1 Apache OpenOffice versions prior to 4.1.2

Description The issue is caused by a buffer overflow, allowing a remote attacker to cause a denial of service or execute arbitrary code via an index to a non-existent bookmark in a DOC file. This can lead to memory corruption and application crash.

Recommendations For LibreOffice versions prior to 4.4.6, update to version 4.4.6 or later. For LibreOffice 5.x versions prior to 5.0.1, update to version 5.0.1 or later. For Apache OpenOffice versions prior to 4.1.2, update to version 4.1.2 or later. As a temporary workaround, consider avoiding the use of DOC files with non-existent bookmarks until a patch is available.

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2015-12103

CESA-2015_2619

CVE-2015-5214

DSA-3394-1

MGASA-2015-0441

OPENSUSE-SU-2024:10006-1

RHSA-2015:2619

RHSA-2015_2619

SUSE-SU-2015:1915-1

SUSE-SU-2016:0324-1

USN-2793-1

Affected Products

Apache Openoffice

Centos

Libreoffice

Openoffice

Red Hat

Suse

Ubuntu

References · 130

• http://rhn.redhat.com/errata/RHSA-2015-2619.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5214 · Security Note
• https://ubuntu.com/security/CVE-2015-5212 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10006-1 · Vendor Advisory
• https://security.gentoo.org/glsa/201611-03 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2015-5214 · Security Note
• https://osv.dev/vulnerability/CVE-2015-5214 · Vendor Advisory
• http://debian.org/security/2015/dsa-3394 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se15-bulletin-20201201SE15 · Vendor Advisory
• http://openoffice.org/security/cves/CVE-2015-5214.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-12102 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5213 · Security Note
• https://osv.dev/vulnerability/USN-2793-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-12101 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5212 · Security Note