CoreCVE
Back

MEDIUM

openoffice: Arbitrary file disclosure via crafted OLE objects

Published Aug 27, 2014

Description

The OLE preview generation in Apache OpenOffice before 4.1.1 and OpenOffice.org (OOo) might allow remote attackers to embed arbitrary data into documents via crafted OLE objects.

Affected products

Remediation

Red Hat statement

This issue affects the version of OpenOffice.org as shipped in Red Hat Enterprise Linux 5, and the version of LibreOffice as shipped in Red Hat Enterprise Linux 6. Red Hat Product Security has rated this issue as having Moderate security impact and is not planned to be addressed in any future updates.

Red Hat mitigation

- Whenever possible, exercise caution when opening documents sent by unknown/untrusted parties. - If "Update Links" dialog is seen, when opening a document, do not send this document to others, since it may be possible that local files got attached to the document. (The exploit only works when the document is sent over to the attacker after opening it on your system using LibreOffice/OpenOffice)

Metrics

Weaknesses (1)

CWE-200

Exposure of Sensitive Information

References (15)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner redhat
Published Aug 27, 2014
Updated Aug 6, 2024
Reserved May 14, 2014
Link CVE-2014-3575
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2014-3575
Red Hat
Severity Moderate
Public date Aug 21, 2014
Links CVE-2014-3575 - Bugzilla