CVE-2014-3575

Title: CVE-2014-3575

Announced: August 21, 2014

Fixed in: LibreOffice 4.2.6-secfix/4.3.1

Description:

The vulnerability allows an attacker to send a document which when opened will trigger the prompt to "Update Links" but if the user cancels that prompt may still generate and insert into the document an OLE2 preview image of a file on the victims filesystem, Data exposure is possible if the updated document is then distributed to other parties.

All users are recommended to upgrade to LibreOffice 4.2.6-secfix or 4.3.1.

Thanks to Malte Timmermann of Open-Xchange for discovering this flaw.

References:

CVE-2014-3575

Impressum (Legal Info) | Datenschutzerklärung (Privacy Policy) | Statutes (non-binding English translation) - Satzung (binding German version) | Copyright information: Unless otherwise specified, all text and images on this website are licensed under the Creative Commons Attribution-Share Alike 3.0 License. This does not include the source code of LibreOffice, which is licensed under the Mozilla Public License v2.0. “LibreOffice” and “The Document Foundation” are registered trademarks of their corresponding registered owners or are in actual use as trademarks in one or more countries. Their respective logos and icons are also subject to international copyright laws. Use thereof is explained in our trademark policy. LibreOffice was based on OpenOffice.org.

CVE-2014-3575

Follow Us