LibreOffice 4.2.4 executes unspecified VBA macros automatically, which has unspecified impact and attack vectors, possibly related to doc/docmacromode.cxx.

It was found that LibreOffice documents executed macros unconditionally, without user approval, when these documents were opened using LibreOffice. An attacker could use this flaw to execute arbitrary code as the user running LibreOffice by embedding malicious VBA scripts in the document as macros. (CVE-2014-0247)

A flaw was found in the OLE (Object Linking and Embedding) generation in LibreOffice. An attacker could use this flaw to embed malicious OLE code in a LibreOffice document, allowing for arbitrary code execution.
(CVE-2014-3575)

A use-after-free flaw was found in the 'Remote Control' capabilities of the LibreOffice Impress application. An attacker could use this flaw to remotely execute code with the permissions of the user running LibreOffice Impress. (CVE-2014-3693)

The libreoffice packages have been upgraded to upstream version 4.2.6.3, which provides a number of bug fixes and enhancements over the previous version. Among others :

  - Improved OpenXML interoperability.

  - Additional statistic functions in Calc (for     interoperability with Excel and Excel's Add-in 'Analysis     ToolPak').

  - Various performance improvements in Calc.

  - Apple Keynote and Abiword import.

  - Improved MathML export.

  - New Start screen with thumbnails of recently opened     documents.

  - Visual clue in Slide Sorter when a slide has a     transition or an animation.

  - Improvements for trend lines in charts.

  - Support for BCP-47 language tags.

Updated libreoffice packages that fix three security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a drawing program. LibreOffice replaces OpenOffice and provides a similar but enhanced and extended office suite.

It was found that LibreOffice documents executed macros unconditionally, without user approval, when these documents were opened using LibreOffice. An attacker could use this flaw to execute arbitrary code as the user running LibreOffice by embedding malicious VBA scripts in the document as macros. (CVE-2014-0247)

A flaw was found in the OLE (Object Linking and Embedding) generation in LibreOffice. An attacker could use this flaw to embed malicious OLE code in a LibreOffice document, allowing for arbitrary code execution.
(CVE-2014-3575)

A use-after-free flaw was found in the 'Remote Control' capabilities of the LibreOffice Impress application. An attacker could use this flaw to remotely execute code with the permissions of the user running LibreOffice Impress. (CVE-2014-3693)

The libreoffice packages have been upgraded to upstream version 4.2.6.3, which provides a number of bug fixes and enhancements over the previous version. Among others :

* Improved OpenXML interoperability.

* Additional statistic functions in Calc (for interoperability with Excel and Excel's Add-in 'Analysis ToolPak').

* Various performance improvements in Calc.

* Apple Keynote and Abiword import.

* Improved MathML export.

* New Start screen with thumbnails of recently opened documents.

* Visual clue in Slide Sorter when a slide has a transition or an animation.

* Improvements for trend lines in charts.

* Support for BCP-47 language tags. (BZ#1119709)

All libreoffice users are advised to upgrade to these updated packages, which correct these issues and add these enhancements.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-0377 advisory.

    - CVE-2014-3693: Disable sdremote by default and improve flow control

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201408-19 (OpenOffice, LibreOffice: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in OpenOffice and       Libreoffice. Please review the CVE identifiers referenced below for       details.
  Impact :

    A remote attacker could entice a user to open a specially crafted file       using OpenOffice, possibly resulting in execution of arbitrary code with       the privileges of the process, a Denial of Service condition, execution       of arbitrary Python code, authentication bypass, or reading and writing       of arbitrary files.
  Workaround :

    There is no known workaround at this time.

A version of LibreOffice is installed on the remote Mac OS X host that is between versions 4.1.4 and 4.2.4. It is, therefore, affected by a vulnerability that allows the execution of unspecified VBA macros automatically.

Note that Nessus has not attempted to exploit this issue, but has instead relied only on the application's self-reported version number.

A version of LibreOffice is installed on the remote Windows host that is between versions 4.1.4 and 4.2.4. It is, therefore, affected by a vulnerability that allows the execution of unspecified VBA macros automatically.

Note that Nessus has not attempted to exploit this issue, but has instead relied only on the application's self-reported version number.

This update fixes CVE-2014-0247 which allowed for unconditional execution of VBA macros when opening certain documents.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

libreoffice was updated to version 4.1.6.2, thereby fixing over 80 bugs.

This security issue was fixed :

  - VBA macros executed unconditionally (CVE-2014-0247)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2253-1 advisory.

    It was discovered that LibreOffice unconditionally executed certain VBA macros, contrary to user     expectations.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
82256	Scientific Linux Security Update : libreoffice on SL7.x x86_64 (20150305)	Nessus	Scientific Linux Local Security Checks	critical
81892	CentOS 7 : libabw / libcmis / libetonyek / libfreehand / liblangtag / libmwaw / libodfgen / etc (CESA-2015:0377)	Nessus	CentOS Local Security Checks	critical
81804	Oracle Linux 7 : libreoffice (ELSA-2015-0377)	Nessus	Oracle Linux Local Security Checks	critical
81633	RHEL 7 : libreoffice (RHSA-2015:0377)	Nessus	Red Hat Local Security Checks	critical
77467	GLSA-201408-19 : OpenOffice, LibreOffice: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
76595	LibreOffice < 4.2.5 Unspecified Macro Code Execution (Mac OS X)	Nessus	MacOS X Local Security Checks	critical
76594	LibreOffice < 4.2.5 Unspecified Macro Code Execution	Nessus	Windows	critical
76350	Fedora 19 : libreoffice-4.1.6.2-7.fc19 (2014-7679)	Nessus	Fedora Local Security Checks	critical
76337	openSUSE Security Update : libreoffice (openSUSE-SU-2014:0860-1)	Nessus	SuSE Local Security Checks	critical
76200	Ubuntu 14.04 LTS : LibreOffice vulnerability (USN-2253-1)	Nessus	Ubuntu Local Security Checks	critical

Detections

Analytics

CVE-2014-0247

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical