Bug 1278827 (CVE-2015-5214)

Summary:	CVE-2015-5214 libreoffice: Bookmarks in DOC documents are insufficiently checked causing memory corruption
Product:	[Other] Security Response	Reporter:	Adam Mariš <amaris>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	caolanm, dtardon, erack, ltinkl, mstahl, sbergman
Target Milestone:	---	Keywords:	Reopened, Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	libreoffice 4.4.6, libreoffice 5.0.1, openoffice 4.1.2	Doc Type:	Bug Fix
Doc Text:	It was discovered that LibreOffice did not properly sanity check bookmark indexes. By tricking a user into opening a specially crafted document, an attacker could possibly use this flaw to execute arbitrary code with the privileges of the user opening the file.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-12-14 06:20:26 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1278829, 1285818, 1285819, 1285820, 1285821
Bug Blocks:	1278830

Description Adam Mariš 2015-11-06 13:58:49 UTC

It was found that indexes into the bookmark array were insufficiently checked for validity. A document can be constructed which refers to bookmarks that don't exist, causing memory corruption.

Products affected are LibreOffice < 4.4.6 and OpenOffice <= 4.1.1.

External reference:

http://www.libreoffice.org/about-us/security/advisories/cve-2015-5214/
http://www.openoffice.org/security/cves/CVE-2015-5214.html

Comment 1 Adam Mariš 2015-11-06 13:59:18 UTC

Created libreoffice tracking bugs for this issue:

Affects: fedora-all [bug 1278829]

Comment 6 errata-xmlrpc 2015-12-14 05:51:00 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6
  Red Hat Enterprise Linux 7

Via RHSA-2015:2619 https://rhn.redhat.com/errata/RHSA-2015-2619.html