Lucene search

K
mageiaGentoo FoundationMGASA-2014-0447
HistoryNov 14, 2014 - 4:24 a.m.

Updated libreoffice packages fix security vulnerabilities

2014-11-1404:24:42
Gentoo Foundation
advisories.mageia.org
8

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.013 Low

EPSS

Percentile

85.8%

It was discovered during routine code review that LibreOffice unconditionally executed certain VBA macros on loading Microsoft Office documents, contrary to user expectations (CVE-2014-0247). A vulnerability in LibreOffice allows an attacker to send a document which when opened will trigger the prompt to “Update Links” but if the user cancels that prompt may still generate and insert into the document an OLE2 preview image of a file on the victims filesystem, Data exposure is possible if the updated document is then distributed to other parties (CVE-2014-3575). LibreOffice has been updated to version 4.1.6.2 and patched to fix the CVE-2014-0247 and CVE-2014-3575 issues as well as to fix other bugs.

OSVersionArchitecturePackageVersionFilename
Mageia4noarchlibreoffice< 4.1.6.2-1libreoffice-4.1.6.2-1.mga4

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.013 Low

EPSS

Percentile

85.8%