CVE-2015-4551

LibreOffice < 4.4.5 and Apache OpenOffice < 4.1.2 - Information Disclosure via Embedded Local File Data

Title source: llm
STIX 2.1

Description

LibreOffice before 4.4.5 and Apache OpenOffice before 4.1.2 uses the stored LinkUpdateMode configuration information in OpenDocument Format files and templates when handling links, which might allow remote attackers to obtain sensitive information via a crafted document, which embeds data from local files into (1) Calc or (2) Writer.

References (11)

Core 11
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1034085
Third Party Advisory vendor-advisory x_refsource_gentoo
https://security.gentoo.org/glsa/201611-03
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1034091
Third Party Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2015-2619.html
Third Party Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-2793-1
Broken Link, Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/77486
Third Party Advisory vendor-advisory x_refsource_gentoo
https://security.gentoo.org/glsa/201603-05
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2015/dsa-3394

Scores

EPSS 0.0775
EPSS Percentile 92.1%

Details

CWE
CWE-200
Status published
Products (7)
apache/openoffice < 4.1.1
canonical/ubuntu_linux 12.04
canonical/ubuntu_linux 14.04
canonical/ubuntu_linux 15.04
debian/debian_linux 7.0
debian/debian_linux 8.0
libreoffice/libreoffice < 4.4.4
Published Nov 10, 2015
Tracked Since Feb 18, 2026