Information Leak and Buffer Overflow in LibreOffice
Summary
DSA-3394-1: libreoffice - security update. Affects libreoffice versions < 1:3.5.4+dfsg2-0+deb7u5. Fixed in 1:3.5.4+dfsg2-0+deb7u5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
LibreOffice is a full-featured office productivity suite that provides a range of applications for word processing, spreadsheets, presentations, and more. It is widely used by individuals and organizations for creating and editing documents. However, certain versions of LibreOffice are vulnerable to information leaks and buffer overflows, which can lead to unauthorized access and execution of arbitrary code.
Vulnerability Detail
The first vulnerability, identified as CVE-2015-4551, involves an information leak in the handling of ODF documents. Attackers can craft documents with links to plausible targets on the victim's host computer, and the contents of these links can be concealed and retrieved by the attacker. This can occur if the document is saved and returned to the sender or through HTTP requests if the user has selected lower security settings for the document.
The second vulnerability, CVE-2015-5212, is a buffer overflow that occurs when parsing the printer setup information in ODF documents. This can allow an attacker to execute arbitrary code.
The third vulnerability, CVE-2015-5213 and CVE-2015-5214, involves a buffer overflow and an integer overflow respectively, both occurring when parsing Microsoft Word documents. These vulnerabilities can also result in the execution of arbitrary code.
How To Fix
Minimum fixed version
1:3.5.4+dfsg2-0+deb7u5
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libreofficeTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for these vulnerabilities. It is recommended to apply the available fixes by upgrading to the patched versions of LibreOffice.
Conclusion
LibreOffice versions prior to the fixed versions mentioned in the 'how_to_fix' section are vulnerable to information leaks and buffer overflows. It is crucial to upgrade to the patched versions to ensure the security of your documents and prevent unauthorized access or code execution. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for libreoffice →
FAQ
LibreOffice is a full-featured office productivity suite that provides applications for word processing, spreadsheets, presentations, and more.
An information leak vulnerability allows an attacker to access sensitive information that should be protected, such as personal data or system configurations.
A buffer overflow vulnerability occurs when a program writes more data into a buffer than it can hold, potentially overwriting adjacent memory and leading to unauthorized code execution.
An attacker can exploit these vulnerabilities by crafting malicious documents that trigger the information leaks or buffer overflows when opened or processed by LibreOffice.
There are no specific instances mentioned in the vulnerability details. However, it is important to apply the recommended fixes to mitigate the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for libreoffice.
