The HWP filter in LibreOffice before 4.3.7 and 4.4.x before 4.4.2 and Apache OpenOffice before 4.1.2 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted HWP document, which triggers an out-of-bounds write.

The remote host is affected by the vulnerability described in GLSA-201603-05 (LibreOffice, OpenOffice: Multiple vulnerabilities)

    Multiple vulnerabilities were found in both LibreOffice and OpenOffice       that allow the remote execution of arbitrary code and potential Denial of       Service.  These vulnerabilities may be exploited through multiple vectors       including crafted documents, link handling, printer setup in ODF document       types, DOC file formats, and Calc spreadsheets.  Please review the       referenced CVE&rsquo;s for specific information regarding each.
  Impact :

    A remote attacker could entice a user to open a specially crafted file       using the LibreOffice or OpenOffice suite of software.  Execution of       these attacks could possibly result in the execution of arbitrary code       with the privileges of the process or a Denial of Service condition.
  Workaround :

    There is no known work around at this time.

The version of Apache OpenOffice installed on the remote host is a version prior to 4.1.2. It is, therefore, affected by the following vulnerabilities :

  - An overflow condition exists in the Hangul Word     Processor (HWP) filter due to improper validation of     user-supplied input. A remote attacker can exploit this,     via a specially crafted HWP document, to cause a denial     of service condition or the execution of arbitrary code.
    (CVE-2015-1774)

  - An information disclosure vulnerability exists due to     the use of stored LinkUpdateMode configuration     information in OpenDocument Format files and templates     when handling links. A remote attacker can exploit this,     via a specially crafted ODF document, to to obtain     sensitive information. (CVE-2015-4551)

  - An integer underflow condition exists in the     ReadJobSetup() function due to improper validation of     user-supplied input when handling printer settings. A     remote attacker can exploit this, via specially crafted     PrinterSetup data in an ODF document, to cause a denial     of service condition or the execution of arbitrary code.
    (CVE-2015-5212)

  - An integer underflow condition exists in the     WW8ScannerBase::OpenPieceTable() function due to     improper validation of user-supplied input when handling     the PieceTable counter. A remote attacker can exploit     this, via a specially crafted .DOC file, to cause a     denial of service condition or the execution of     arbitrary code. (CVE-2015-5213)

  - A memory corruption issue exists in     'filter/ww8/ww8scan.cxx' due to improper validation of     user-supplied input when handling bookmark status     positions. A remote attacker can exploit this, via a     specially crafted document, to cause a denial of service     condition or the execution of arbitrary code.
    (CVE-2015-5214)

This update brings LibreOffice to version 5.0.2, a major version update.

It brings lots of new features, bugfixes and also security fixes.

Features as seen on http://www.libreoffice.org/discover/new-features/

  - LibreOffice 5.0 ships an impressive number of new     features for its spreadsheet module, Calc: complex     formulae image cropping, new functions, more powerful     conditional formatting, table addressing and much more.
    Calc's blend of performance and features makes it an     enterprise-ready, heavy duty spreadsheet application     capable of handling all kinds of workload for an     impressive range of use cases

  - New icons, major improvements to menus and sidebar : no     other LibreOffice version has looked that good and     helped you be creative and get things done the right     way. In addition, style management is now more intuitive     thanks to the visualization of styles right in the     interface.

  - LibreOffice 5 ships with numerous improvements to     document import and export filters for MS Office, PDF,     RTF, and more. You can now timestamp PDF documents     generated with LibreOffice and enjoy enhanced document     conversion fidelity all around.

The Pentaho Flow Reporting Engine is now added and used.

Security issues fixed :

  - CVE-2014-8146: The resolveImplicitLevels function in     common/ubidi.c in the Unicode Bidirectional Algorithm     implementation in ICU4C in International Components for     Unicode (ICU) before 55.1 did not properly track     directionally isolated pieces of text, which allowed     remote attackers to cause a denial of service     (heap-based buffer overflow) or possibly execute     arbitrary code via crafted text.

  - CVE-2014-8147: The resolveImplicitLevels function in     common/ubidi.c in the Unicode Bidirectional Algorithm     implementation in ICU4C in International Components for     Unicode (ICU) before 55.1 used an integer data type that     is inconsistent with a header file, which allowed remote     attackers to cause a denial of service (incorrect malloc     followed by invalid free) or possibly execute arbitrary     code via crafted text.

  - CVE-2015-4551: An arbitrary file disclosure     vulnerability in Libreoffice and Openoffice Calc and     Writer was fixed.

  - CVE-2015-1774: The HWP filter in LibreOffice allowed     remote attackers to cause a denial of service (crash) or     possibly execute arbitrary code via a crafted HWP     document, which triggered an out-of-bounds write.

  - CVE-2015-5212: A LibreOffice 'PrinterSetup Length'     integer underflow vulnerability could be used by     attackers supplying documents to execute code as the     user opening the document.

  - CVE-2015-5213: A LibreOffice 'Piece Table Counter'     invalid check design error vulnerability allowed     attackers supplying documents to execute code as the     user opening the document.

  - CVE-2015-5214: Multiple Vendor LibreOffice Bookmark     Status Memory Corruption Vulnerability allowed attackers     supplying documents to execute code as the user opening     the document.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A flaw was found in the way the LibreOffice HWP (Hangul Word Processor) file filter processed certain HWP documents. An attacker able to trick a user into opening a specially crafted HWP document could possibly use this flaw to execute arbitrary code with the privileges of the user opening that document. (CVE-2015-1774)

The libreoffice packages have been upgraded to upstream version 4.2.8.2, which provides a number of bug fixes and enhancements over the previous version, including :

  - OpenXML interoperability has been improved.

  - This update adds additional statistics functions to the     Calc application, thus improving interoperability with     Microsoft Excel and its 'Analysis ToolPak' add-in.

  - Various performance improvements have been implemented     in Calc.

  - This update adds new import filters for importing files     from the Appple Keynote and Abiword applications.

  - The export filter for the MathML markup language has     been improved.

  - This update adds a new start screen that includes     thumbnails of recently opened documents.

  - A visual clue is now displayed in the Slide Sorter     window for slides with transitions or animations.

  - This update improves trend lines in charts.

  - LibreOffice now supports BCP 47 language tags.

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2015-1458 advisory.

    - Resolves: rhbz#1217466 CVE-2015-1774 HWP filter fix

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Updated libreoffice packages that fix one security issue, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a drawing program. LibreOffice replaces OpenOffice and provides a similar but enhanced and extended office suite.

A flaw was found in the way the LibreOffice HWP (Hangul Word Processor) file filter processed certain HWP documents. An attacker able to trick a user into opening a specially crafted HWP document could possibly use this flaw to execute arbitrary code with the privileges of the user opening that document. (CVE-2015-1774)

The libreoffice packages have been upgraded to upstream version 4.2.8.2, which provides a number of bug fixes and enhancements over the previous version, including :

* OpenXML interoperability has been improved.

* This update adds additional statistics functions to the Calc application, thus improving interoperability with Microsoft Excel and its 'Analysis ToolPak' add-in.

* Various performance improvements have been implemented in Calc.

* This update adds new import filters for importing files from the Appple Keynote and Abiword applications.

* The export filter for the MathML markup language has been improved.

* This update adds a new start screen that includes thumbnails of recently opened documents.

* A visual clue is now displayed in the Slide Sorter window for slides with transitions or animations.

* This update improves trend lines in charts.

* LibreOffice now supports BCP 47 language tags.

For a complete list of bug fixes and enhancements provided by this rebase, see the libreoffice change log linked from the References section. (BZ#1150048)

Users of libreoffice are advised to upgrade to these updated packages, which correct these issues and add these enhancements.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2015:1458 advisory.

  - libreoffice: HWP file filter vulnerability (CVE-2015-1774)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

LibreOffice was updated to 4.3.7 to fix one security issue and a number of bugs.

The following vulnerability was fixed :

  - CVE-2015-1774: Specially crafted HWP documents could     have led to an application crash or possibly the     execution of arbitrary code (boo#919409)

The following non-security bugs were fixed :

  - boo#881214: Failed to launch reprots wizard in     libreoffice-base with error     'java.lang.NoClassDefFoundError'

In addition this update contains all upstream fixes of the 4.3.7 series.

CVE-2015-1774: out-of-bounds write in HWP file filter

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

US-CERT/NIST reports :

The HWP filter in LibreOffice before 4.3.7 and 4.4.x before 4.4.2 and Apache OpenOffice before 4.1.2 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted HWP document, which triggers an out-of-bounds write.

Fix some .docx import crashes. And finally fix the re-render of checked->unchecked checkbox transition

update to 4.3.7

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2578-1 advisory.

    Alexander Cherepanov discovered that LibreOffice incorrectly handled certain RTF files. If a user were     tricked into opening a specially crafted RTF document, a remote attacker could cause LibreOffice to crash,     and possibly execute arbitrary code. (CVE-2014-9093)

    It was discovered that LibreOffice incorrectly handled certain HWP files. If a user were tricked into     opening a specially crafted HWP document, a remote attacker could cause LibreOffice to crash, and possibly     execute arbitrary code. (CVE-2015-1774)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It was discovered that missing input sanitising in Libreoffice's filter for HWP documents may result in the execution of arbitrary code if a malformed document is opened.

ID	Name	Product	Family	Severity
89811	GLSA-201603-05 : LibreOffice, OpenOffice: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
86904	Apache OpenOffice < 4.1.2 Multiple Vulnerabilities	Nessus	Windows	medium
86757	SUSE SLED12 / SLES12 Security Update : Recommended update for LibreOffice (SUSE-SU-2015:1915-1)	Nessus	SuSE Local Security Checks	high
85199	Scientific Linux Security Update : libreoffice on SL6.x i386/x86_64 (20150722)	Nessus	Scientific Linux Local Security Checks	medium
85110	Oracle Linux 6 : libreoffice (ELSA-2015-1458)	Nessus	Oracle Linux Local Security Checks	critical
85024	CentOS 6 : libreoffice (CESA-2015:1458)	Nessus	CentOS Local Security Checks	medium
84950	RHEL 6 : libreoffice (RHSA-2015:1458)	Nessus	Red Hat Local Security Checks	critical
83396	openSUSE Security Update : libreoffice (openSUSE-2015-357)	Nessus	SuSE Local Security Checks	medium
83325	Fedora 20 : libreoffice-4.2.8.2-8.fc20 (2015-7213)	Nessus	Fedora Local Security Checks	medium
83281	FreeBSD : Vulnerability in HWP document filter (b13af778-f4fc-11e4-a95d-ac9e174be3af)	Nessus	FreeBSD Local Security Checks	medium
83154	Fedora 21 : libreoffice-4.3.7.2-3.fc21 (2015-7022)	Nessus	Fedora Local Security Checks	medium
83110	Ubuntu 14.04 LTS : LibreOffice vulnerabilities (USN-2578-1)	Nessus	Ubuntu Local Security Checks	critical
83064	Debian DSA-3236-1 : libreoffice - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2015-1774

critical

Tenable Plugins

high

medium

high

medium

critical

medium

critical

medium

medium

medium

medium

critical

medium