glsa-201603-05.xml


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
<glsa id="201603-05">
  <title>LibreOffice, OpenOffice: Multiple vulnerabilities</title>
  <synopsis>Multiple vulnerabilities have been found in both LibreOffice and
    OpenOffice allowing remote attackers to execute arbitrary code or cause
    Denial of Service.
  </synopsis>
  <product type="ebuild"/>
  <announced>2016-03-09</announced>
  <revised count="1">2016-03-09</revised>
  <bug>521136</bug>
  <bug>522060</bug>
  <bug>528438</bug>
  <bug>534684</bug>
  <bug>547880</bug>
  <bug>547900</bug>
  <bug>565028</bug>
  <access>remote</access>
  <affected>
    <package name="app-office/libreoffice" auto="yes" arch="*">
      <unaffected range="ge">4.4.2</unaffected>
      <vulnerable range="lt">4.4.2</vulnerable>
    </package>
    <package name="app-office/libreoffice-bin" auto="yes" arch="*">
      <unaffected range="ge">4.4.2</unaffected>
      <vulnerable range="lt">4.4.2</vulnerable>
    </package>
    <package name="app-office/libreoffice-bin-debug" auto="yes" arch="*">
      <unaffected range="ge">4.4.2</unaffected>
      <vulnerable range="lt">4.4.2</vulnerable>
    </package>
    <package name="app-office/openoffice-bin" auto="yes" arch="*">
      <unaffected range="ge">4.1.2</unaffected>
      <vulnerable range="lt">4.1.2</vulnerable>
    </package>
  </affected>
  <background>
    <p>Apache OpenOffice is the leading open-source office software suite for
      word processing, spreadsheets, presentations, graphics, databases and
      more.
    </p>
    
    <p>LibreOffice is a powerful office suite; its clean interface and powerful
      tools let you unleash your creativity and grow your productivity.
    </p>
  </background>
  <description>
    <p>Multiple vulnerabilities were found in both LibreOffice and OpenOffice
      that allow the remote execution of arbitrary code and potential Denial of
      Service.  These vulnerabilities may be exploited through multiple vectors
      including crafted documents, link handling, printer setup in ODF document
      types, DOC file formats, and Calc spreadsheets.  Please review the
      referenced CVE’s for specific information regarding each.
    </p>
  </description>
  <impact type="normal">
    <p>A remote attacker could entice a user to open a specially crafted file
      using the LibreOffice or OpenOffice suite of software.  Execution of
      these attacks could possibly result in the execution of arbitrary code
      with the privileges of the process or a Denial of Service condition.
    </p>
  </impact>
  <workaround>
    <p>There is no known work around at this time.</p>
  </workaround>
  <resolution>
    <p>All LibreOffice users should upgrade their respective packages to the
      latest version:
    </p>
    
    <code>
      # emerge --sync
      # emerge --ask --oneshot --verbose "&gt;=app-office/libreoffice-4.4.2"
      # emerge --ask --oneshot --verbose
      "&gt;=app-office/libreoffice-bin-4.4.2"# emerge --ask --oneshot --verbose
      "&gt;=app-office/libreoffice-bin-debug-4.4.2"
    </code>
    
    <p>All OpenOffice users should upgrade to the latest version:</p>
    
    <code>
      # emerge --sync
      # emerge --ask --oneshot --verbose "&gt;=app-office/openoffice-bin-4.1.2"
    </code>
  </resolution>
  <references>
    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-3524">CVE-2014-3524</uri>
    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-3575">CVE-2014-3575</uri>
    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-3693">CVE-2014-3693</uri>
    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-9093">CVE-2014-9093</uri>
    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-1774">CVE-2015-1774</uri>
    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4551">CVE-2015-4551</uri>
    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5212">CVE-2015-5212</uri>
    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5213">CVE-2015-5213</uri>
    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5214">CVE-2015-5214</uri>
  </references>
  <metadata tag="requester" timestamp="2015-02-15T17:50:17Z">K_F</metadata>
  <metadata tag="submitter" timestamp="2016-03-09T18:08:54Z">b-man</metadata>
</glsa>