The OLE preview generation in Apache OpenOffice before 4.1.1 and OpenOffice.org (OOo) might allow remote attackers to embed arbitrary data into documents via crafted OLE objects.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - libreoffice: multiple null pointer dereference flaws (CVE-2012-4233)

  - openoffice: Arbitrary file disclosure via crafted OLE objects (CVE-2014-3575)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - libreoffice: Multiple out-of-bounds overflows in lwp filter (CVE-2016-0795)

  - libreoffice: heap-based buffer overflow related to the ReadJPEG function (CVE-2017-8358)

  - LibreOffice 3.5.x before 3.5.7.2 and 3.6.x before 3.6.1, and OpenOffice.org (OOo), allows remote attackers     to cause a denial of service (NULL pointer dereference) via a crafted (1) odt file to vcllo.dll, (2) ODG     (Drawing document) file to svxcorelo.dll, (3) PolyPolygon record in a .wmf (Window Meta File) file     embedded in a ppt (PowerPoint) file to tllo.dll, or (4) xls (Excel) file to scfiltlo.dll. (CVE-2012-4233)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

Apache reports :

The exposure exploits the way OLE previews are generated to embed arbitrary file data into a specially crafted document when it is opened. Data exposure is possible if the updated document is distributed to other parties.

The remote host is affected by the vulnerability described in GLSA-201603-05 (LibreOffice, OpenOffice: Multiple vulnerabilities)

    Multiple vulnerabilities were found in both LibreOffice and OpenOffice       that allow the remote execution of arbitrary code and potential Denial of       Service.  These vulnerabilities may be exploited through multiple vectors       including crafted documents, link handling, printer setup in ODF document       types, DOC file formats, and Calc spreadsheets.  Please review the       referenced CVE&rsquo;s for specific information regarding each.
  Impact :

    A remote attacker could entice a user to open a specially crafted file       using the LibreOffice or OpenOffice suite of software.  Execution of       these attacks could possibly result in the execution of arbitrary code       with the privileges of the process or a Denial of Service condition.
  Workaround :

    There is no known work around at this time.

It was found that LibreOffice documents executed macros unconditionally, without user approval, when these documents were opened using LibreOffice. An attacker could use this flaw to execute arbitrary code as the user running LibreOffice by embedding malicious VBA scripts in the document as macros. (CVE-2014-0247)

A flaw was found in the OLE (Object Linking and Embedding) generation in LibreOffice. An attacker could use this flaw to embed malicious OLE code in a LibreOffice document, allowing for arbitrary code execution.
(CVE-2014-3575)

A use-after-free flaw was found in the 'Remote Control' capabilities of the LibreOffice Impress application. An attacker could use this flaw to remotely execute code with the permissions of the user running LibreOffice Impress. (CVE-2014-3693)

The libreoffice packages have been upgraded to upstream version 4.2.6.3, which provides a number of bug fixes and enhancements over the previous version. Among others :

  - Improved OpenXML interoperability.

  - Additional statistic functions in Calc (for     interoperability with Excel and Excel's Add-in 'Analysis     ToolPak').

  - Various performance improvements in Calc.

  - Apple Keynote and Abiword import.

  - Improved MathML export.

  - New Start screen with thumbnails of recently opened     documents.

  - Visual clue in Slide Sorter when a slide has a     transition or an animation.

  - Improvements for trend lines in charts.

  - Support for BCP-47 language tags.

Updated libreoffice packages that fix three security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a drawing program. LibreOffice replaces OpenOffice and provides a similar but enhanced and extended office suite.

It was found that LibreOffice documents executed macros unconditionally, without user approval, when these documents were opened using LibreOffice. An attacker could use this flaw to execute arbitrary code as the user running LibreOffice by embedding malicious VBA scripts in the document as macros. (CVE-2014-0247)

A flaw was found in the OLE (Object Linking and Embedding) generation in LibreOffice. An attacker could use this flaw to embed malicious OLE code in a LibreOffice document, allowing for arbitrary code execution.
(CVE-2014-3575)

A use-after-free flaw was found in the 'Remote Control' capabilities of the LibreOffice Impress application. An attacker could use this flaw to remotely execute code with the permissions of the user running LibreOffice Impress. (CVE-2014-3693)

The libreoffice packages have been upgraded to upstream version 4.2.6.3, which provides a number of bug fixes and enhancements over the previous version. Among others :

* Improved OpenXML interoperability.

* Additional statistic functions in Calc (for interoperability with Excel and Excel's Add-in 'Analysis ToolPak').

* Various performance improvements in Calc.

* Apple Keynote and Abiword import.

* Improved MathML export.

* New Start screen with thumbnails of recently opened documents.

* Visual clue in Slide Sorter when a slide has a transition or an animation.

* Improvements for trend lines in charts.

* Support for BCP-47 language tags. (BZ#1119709)

All libreoffice users are advised to upgrade to these updated packages, which correct these issues and add these enhancements.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-0377 advisory.

    - CVE-2014-3693: Disable sdremote by default and improve flow control

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A version of LibreOffice is installed on the remote Windows host that is 4.3.x prior to 4.3.1. It is, therefore, affected by the following vulnerabilities :

  - An input-validation error exists related to handling     Calc spreadsheets that allows arbitrary command     execution. (CVE-2014-3524)

  - An input-validation error exists related to 'Update     Links' prompt handling that allows information     disclosure via improperly included OLE2 previews.
    (CVE-2014-3575)

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

A version of LibreOffice is installed on the remote Windows host that is 4.x prior to 4.2.6-secfix (4.2.6.3). It is, therefore, affected by the following vulnerabilities :

  - An input-validation error exists related to handling     Calc spreadsheets that allows arbitrary command     execution. (CVE-2014-3524)

  - An input-validation error exists related to 'Update     Links' prompt handling that allows information     disclosure via improperly included OLE2 previews.
    (CVE-2014-3575)

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

It was discovered that LibreOffice incorrectly handled OLE preview generation. If a user were tricked into opening a crafted document, an attacker could possibly exploit this to embed arbitrary data into documents.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes memory corruption vulnerability in DOCM import and data exposure using crafted OLE objects.

CVE-2014-3575 arbitrary file preview disclosure via ole2 objects

The vulnerability allows an attacker to send a document which when opened will trigger the prompt to 'Update Links' but if the user cancels that prompt may still generate and insert into the document an OLE2 preview image of a file on the victims filesystem, Data exposure is possible if the updated document is then distributed to other parties.

Also contains an enhancement to create a master document template type to allow putting master documents in the template manager new bugfix release

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

LibreOffice was updated to version 4.0.3.3.26. (SUSE 4.0-patch26, tag suse-4.0-26, based on upstream 4.0.3.3).

Two security issues have been fixed :

  - DOCM memory corruption vulnerability. (CVE-2013-4156,     bnc#831578)

  - Data exposure using crafted OLE objects. (CVE-2014-3575,     bnc#893141) The following non-security issues have been     fixed :

  - chart shown flipped. (bnc#834722)

  - chart missing dataset. (bnc#839727)

  - import new line in text. (bnc#828390)

  - lines running off screens. (bnc#819614)

  - add set-all language menu. (bnc#863021)

  - text rotation. (bnc#783433, bnc#862510)

  - page border shadow testcase. (bnc#817956)

  - one more clickable field fix. (bnc#802888)

  - multilevel labels are rotated. (bnc#820273)

  - incorrect nested table margins. (bnc#816593)

  - use BitmapURL only if its valid. (bnc#821567)

  - import gradfill for text colors. (bnc#870234)

  - fix undo of paragraph attributes. (bnc#828598)

  - stop-gap solution to avoid crash. (bnc#830205)

  - import images with duotone filter. (bnc#820077)

  - missing drop downs for autofilter. (bnc#834705)

  - typos in first page style creation. (bnc#820836)

  - labels wrongly interpreted as dates. (bnc#834720)

  - RTF import of fFilled shape property. (bnc#825305)

  - placeholders text size is not correct. (bnc#831457)

  - cells value formatted with wrong output. (bnc#821795)

  - RTF import of freeform shape coordinates. (bnc#823655)

  - styles (rename &amp;) copy to different decks.
    (bnc#757432)

  - XLSX Chart import with internal data table. (bnc#819822)

  - handle M.d.yyyy date format in DOCX import. (bnc#820509)

  - paragraph style in empty first page header. (bnc#823651)

  - copying slides having same master page name.
    (bnc#753460)

  - printing handouts using the default, 'Order'.
    (bnc#835985)

  - wrap polygon was based on dest size of picture.
    (bnc#820800)

  - added common flags support for SEQ field import.
    (bnc#825976)

  - hyperlinks of illustration index in DOCX export.
    (bnc#834035)

  - allow insertion of redlines with an empty author.
    (bnc#837302)

  - handle drawinglayer rectangle inset in VML import.
    (bnc#779642)

  - don't apply complex font size to non-complex font.
    (bnc#820819)

  - issue with negative seeks in win32 shell extension.
    (bnc#829017)

  - slide appears quite garbled when imported from PPTX.
    (bnc#593612)

  - initial MCE support in writerfilter ooxml tokenizer.
    (bnc#820503)

  - MSWord uses \xb for linebreaks in DB fields, take 2.
    (bnc#878854)

  - try harder to convert floating tables to text frames.
    (bnc#779620)

  - itemstate in parent style incorrectly reported as set.
    (bnc#819865)

  - default color hidden by Default style in writerfilter.
    (bnc#820504)

  - DOCX document crashes when using internal OOXML filter.
    (bnc#382137)

  - ugly workaround for external leading with symbol fonts.
    (bnc#823626)

  - followup fix for exported xlsx causes errors for     mso2007. (bnc#823935)

  - we only support simple labels in the     InternalDataProvider. (bnc#864396)

  - RTF import: fix import of numbering bullet associated     font. (bnc#823675)

  - page specific footer extended to every pages in DOCX     export. (bnc#654230)

  - v:textbox mso-fit-shape-to-text style property in VML     import. (bnc#820788)

  - w:spacing in a paragraph should also apply to as-char     objects. (bnc#780044)

  - compatibility setting for MS Word wrapping text in less     space. (bnc#822908)

  - fix SwWrtShell::SelAll() to work with empty table at doc     start (bnc#825891)

The version of Apache OpenOffice installed on the remote host is a version prior to 4.1.1. It is, therefore, affected by the following vulnerabilities :

  - An unspecified flaw allows remote attackers to execute     arbitrary commands via a specially crafted Calc     spreadsheet. (CVE-2014-3524)

  - A flaw in the OLE preview generation allows a remote     attacker to embed arbitrary data into documents via     specially crafted OLE objects. (CVE-2014-3575)

ID	Name	Product	Family	Severity
199391	RHEL 5 : libreoffice (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
199335	RHEL 6 : libreoffice (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
93987	FreeBSD : openoffice -- information disclosure vulnerability (ab947396-9018-11e6-a590-14dae9d210b8)	Nessus	FreeBSD Local Security Checks	medium
89811	GLSA-201603-05 : LibreOffice, OpenOffice: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
82256	Scientific Linux Security Update : libreoffice on SL7.x x86_64 (20150305)	Nessus	Scientific Linux Local Security Checks	critical
81892	CentOS 7 : libabw / libcmis / libetonyek / libfreehand / liblangtag / libmwaw / libodfgen / etc (CESA-2015:0377)	Nessus	CentOS Local Security Checks	critical
81804	Oracle Linux 7 : libreoffice (ELSA-2015-0377)	Nessus	Oracle Linux Local Security Checks	critical
81633	RHEL 7 : libreoffice (RHSA-2015:0377)	Nessus	Red Hat Local Security Checks	critical
80080	LibreOffice 4.3.x < 4.3.1 Multiple Vulnerabilities	Nessus	Windows	high
80078	LibreOffice 4.x < 4.2.6-secfix (4.2.6.3) Multiple Vulnerabilities	Nessus	Windows	high
79120	Ubuntu 12.04 LTS : libreoffice vulnerability (USN-2400-1)	Nessus	Ubuntu Local Security Checks	medium
77693	openSUSE Security Update : LibreOffice (openSUSE-SU-2014:1126-1)	Nessus	SuSE Local Security Checks	medium
77676	Fedora 20 : libreoffice-4.2.6.3-3.fc20 (2014-10732)	Nessus	Fedora Local Security Checks	medium
77663	SuSE 11.3 Security Update : LibreOffice (SAT Patch Number 9677)	Nessus	SuSE Local Security Checks	medium
77408	Apache OpenOffice < 4.1.1 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2014-3575

critical

Tenable Plugins

medium

critical

medium

high

critical

critical

critical

critical

high

high

medium

medium

medium

medium

high