Bug 1278812 (CVE-2015-4551)

Summary:	CVE-2015-4551 libreoffice: Arbitrary file disclosure in Calc and Writer
Product:	[Other] Security Response	Reporter:	Adam Mariš <amaris>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	caolanm, dtardon, erack, ltinkl, mstahl, sbergman
Target Milestone:	---	Keywords:	Reopened, Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	libreoffice 4.4.5, libreoffice 5.0.0	Doc Type:	Bug Fix
Doc Text:	It was discovered that LibreOffice did not properly restrict automatic link updates. By tricking a victim into opening specially crafted documents, an attacker could possibly use this flaw to disclose contents of files accessible by the victim.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-12-14 06:20:47 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1278813, 1285818, 1285819, 1285820, 1285821
Bug Blocks:	1278830

Description Adam Mariš 2015-11-06 13:32:09 UTC

A vulnerability in OpenOffice and LibreOffice settings of OpenDocument Format files and templates, allowing silent access to files that are readable from an user account, over-riding the user's default configuration settings, was found. Once these files are imported into a maliciously-crafted document, the data can be silently hidden in the document and possibly exported to an external party without being observed. 

Versions affected by this vulnerability are LibreOffice < 4.4.5 and OpenOffice <= 4.1.1.

External reference:

http://www.libreoffice.org/about-us/security/advisories/cve-2015-4551/
http://www.openoffice.org/security/cves/CVE-2015-4551.html

Comment 1 Adam Mariš 2015-11-06 13:32:40 UTC

Created libreoffice tracking bugs for this issue:

Affects: fedora-all [bug 1278813]

Comment 6 errata-xmlrpc 2015-12-14 05:50:44 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6
  Red Hat Enterprise Linux 7

Via RHSA-2015:2619 https://rhn.redhat.com/errata/RHSA-2015-2619.html