7.5 - CVE-2014-3693

Executive Summary

Informations
Name	CVE-2014-3693	First vendor Publication	2014-11-07
Vendor	Cve	Last vendor Modification	2023-02-13

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Cvss Base Score	7.5	Attack Range	Network
Cvss Impact Score	6.4	Attack Complexity	Low
Cvss Expoit Score	10	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Use-after-free vulnerability in the socket manager of Impress Remote in LibreOffice 4.x before 4.2.7 and 4.3.x before 4.3.3 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted request to TCP port 1599.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3693

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:27595

Oval ID:	oval:org.mitre.oval:def:27595
Title:	USN-2398-1 -- LibreOffice vulnerability
Description:	It was discovered that LibreOffice incorrectly handled the Impress remote control port. An attacker could possibly use this issue to cause Impress to crash, resulting in a denial of service, or possibly execute arbitrary code.
Family:	unix	Class:	patch
Reference(s):	USN-2398-1 CVE-2014-3693	Version:	5
Platform(s):	Ubuntu 14.10 Ubuntu 14.04	Product(s):	libreoffice
Definition Synopsis:
Ubuntu 14.10 release section Ubuntu 14.10 is installed AND libreoffice-core is earlier than 1:4.3.3-0ubuntu1 AND Ubuntu 14.04 release section Ubuntu 14.04 is installed AND libreoffice-core is earlier than 1:4.2.7-0ubuntu1

Definition Id: oval:org.mitre.oval:def:28363

Oval ID:	oval:org.mitre.oval:def:28363
Title:	SUSE-SU-2014:1494-1 -- Security update for libreoffice (moderate)
Description:	libreoffice was updated to version 4.3.3.2 to fix two security issues: These security issues were fixed: - "Document as E-mail" vulnerability (bnc#900218). - Impress remote control use-after-free vulnerability (CVE-2014-3693). Various other fixes are included in the update.
Family:	unix	Class:	patch
Reference(s):	SUSE-SU-2014:1494-1 CVE-2014-3693	Version:	3
Platform(s):	SUSE Linux Enterprise Desktop 12	Product(s):	libreoffice
Definition Synopsis:
SUSE Linux Enterprise Desktop 12 is installed Packages match section libreoffice is earlier than 0:4.3.3.2-6.1 AND libreoffice-base is earlier than 0:4.3.3.2-6.1 AND libreoffice-base-debuginfo is earlier than 0:4.3.3.2-6.1 AND libreoffice-base-drivers-mysql is earlier than 0:4.3.3.2-6.1 AND libreoffice-base-drivers-mysql-debuginfo is earlier than 0:4.3.3.2-6.1 AND libreoffice-base-drivers-postgresql is earlier than 0:4.3.3.2-6.1 AND libreoffice-base-drivers-postgresql-debuginfo is earlier than 0:4.3.3.2-6.1 AND libreoffice-calc is earlier than 0:4.3.3.2-6.1 AND libreoffice-calc-debuginfo is earlier than 0:4.3.3.2-6.1 AND libreoffice-calc-extensions is earlier than 0:4.3.3.2-6.1 AND libreoffice-debuginfo is earlier than 0:4.3.3.2-6.1 AND libreoffice-debugsource is earlier than 0:4.3.3.2-6.1 AND libreoffice-draw is earlier than 0:4.3.3.2-6.1 AND libreoffice-draw-debuginfo is earlier than 0:4.3.3.2-6.1 AND libreoffice-filters-optional is earlier than 0:4.3.3.2-6.1 AND libreoffice-gnome is earlier than 0:4.3.3.2-6.1 AND libreoffice-gnome-debuginfo is earlier than 0:4.3.3.2-6.1 AND libreoffice-impress is earlier than 0:4.3.3.2-6.1 AND libreoffice-impress-debuginfo is earlier than 0:4.3.3.2-6.1 AND libreoffice-mailmerge is earlier than 0:4.3.3.2-6.1 AND libreoffice-math is earlier than 0:4.3.3.2-6.1 AND libreoffice-math-debuginfo is earlier than 0:4.3.3.2-6.1 AND libreoffice-officebean is earlier than 0:4.3.3.2-6.1 AND libreoffice-officebean-debuginfo is earlier than 0:4.3.3.2-6.1 AND libreoffice-pyuno is earlier than 0:4.3.3.2-6.1 AND libreoffice-pyuno-debuginfo is earlier than 0:4.3.3.2-6.1 AND libreoffice-writer is earlier than 0:4.3.3.2-6.1 AND libreoffice-writer-debuginfo is earlier than 0:4.3.3.2-6.1 AND libreoffice-writer-extensions is earlier than 0:4.3.3.2-6.1 AND libreoffice-icon-theme-tango is earlier than 0:4.3.3.2-6.1 AND libreoffice-l10n-af is earlier than 0:4.3.3.2-6.1 AND libreoffice-l10n-ar is earlier than 0:4.3.3.2-6.1 AND libreoffice-l10n-ca is earlier than 0:4.3.3.2-6.1 AND libreoffice-l10n-cs is earlier than 0:4.3.3.2-6.1 AND libreoffice-l10n-da is earlier than 0:4.3.3.2-6.1 AND libreoffice-l10n-de is earlier than 0:4.3.3.2-6.1 AND libreoffice-l10n-en is earlier than 0:4.3.3.2-6.1 AND libreoffice-l10n-es is earlier than 0:4.3.3.2-6.1 AND libreoffice-l10n-fi is earlier than 0:4.3.3.2-6.1 AND libreoffice-l10n-fr is earlier than 0:4.3.3.2-6.1 AND libreoffice-l10n-gu is earlier than 0:4.3.3.2-6.1 AND libreoffice-l10n-hi is earlier than 0:4.3.3.2-6.1 AND libreoffice-l10n-hu is earlier than 0:4.3.3.2-6.1 AND libreoffice-l10n-it is earlier than 0:4.3.3.2-6.1 AND libreoffice-l10n-ja is earlier than 0:4.3.3.2-6.1 AND libreoffice-l10n-ko is earlier than 0:4.3.3.2-6.1 AND libreoffice-l10n-nb is earlier than 0:4.3.3.2-6.1 AND libreoffice-l10n-nl is earlier than 0:4.3.3.2-6.1 AND libreoffice-l10n-nn is earlier than 0:4.3.3.2-6.1 AND libreoffice-l10n-pl is earlier than 0:4.3.3.2-6.1 AND libreoffice-l10n-pt-BR is earlier than 0:4.3.3.2-6.1 AND libreoffice-l10n-pt-PT is earlier than 0:4.3.3.2-6.1 AND libreoffice-l10n-ru is earlier than 0:4.3.3.2-6.1 AND libreoffice-l10n-sk is earlier than 0:4.3.3.2-6.1 AND libreoffice-l10n-sv is earlier than 0:4.3.3.2-6.1 AND libreoffice-l10n-xh is earlier than 0:4.3.3.2-6.1 AND libreoffice-l10n-zh-Hans is earlier than 0:4.3.3.2-6.1 AND libreoffice-l10n-zh-Hant is earlier than 0:4.3.3.2-6.1 AND libreoffice-l10n-zu is earlier than 0:4.3.3.2-6.1

Definition Id: oval:org.mitre.oval:def:28472

Oval ID:	oval:org.mitre.oval:def:28472
Title:	SUSE-SU-2014:1544-1 -- Security update for LibreOffice (moderate)
Description:	LibreOffice was updated to fix two security issues. These security issues have been fixed: * "Document as E-mail" vulnerability (bnc#900218). * Impress remote control use-after-free vulnerability (CVE-2014-3693). Security Issues: * CVE-2014-3693 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3693>
Family:	unix	Class:	patch
Reference(s):	SUSE-SU-2014:1544-1 CVE-2014-3693	Version:	3
Platform(s):	SUSE Linux Enterprise Desktop 11	Product(s):	LibreOffice
Definition Synopsis:
SUSE Linux Enterprise Desktop 11.x is installed Packages match section libreoffice is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-base is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-base-drivers-postgresql is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-base-extensions is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-calc is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-calc-extensions is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-draw is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-draw-extensions is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-filters-optional is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-gnome is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-impress is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-impress-extensions is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-kde is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-kde4 is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-mailmerge is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-math is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-mono is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-officebean is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-pyuno is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-writer is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-writer-extensions is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-help-cs is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-help-da is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-help-de is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-help-en-GB is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-help-en-US is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-help-es is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-help-fr is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-help-gu-IN is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-help-hi-IN is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-help-hu is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-help-it is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-help-ja is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-help-ko is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-help-nl is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-help-pl is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-help-pt is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-help-pt-BR is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-help-ru is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-help-sv is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-help-zh-CN is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-help-zh-TW is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-icon-themes is earlier than 0:4.0.3.3.26-0.10.1 AND libreoffice-l10n-af is earlier than 0:4.0.3.3.26-0.10.1 AND libreoffice-l10n-ar is earlier than 0:4.0.3.3.26-0.10.1 AND libreoffice-l10n-ca is earlier than 0:4.0.3.3.26-0.10.1 AND libreoffice-l10n-cs is earlier than 0:4.0.3.3.26-0.10.1 AND libreoffice-l10n-da is earlier than 0:4.0.3.3.26-0.10.1 AND libreoffice-l10n-de is earlier than 0:4.0.3.3.26-0.10.1 AND libreoffice-l10n-en-GB is earlier than 0:4.0.3.3.26-0.10.1 AND libreoffice-l10n-es is earlier than 0:4.0.3.3.26-0.10.1 AND libreoffice-l10n-fi is earlier than 0:4.0.3.3.26-0.10.1 AND libreoffice-l10n-fr is earlier than 0:4.0.3.3.26-0.10.1 AND libreoffice-l10n-gu-IN is earlier than 0:4.0.3.3.26-0.10.1 AND libreoffice-l10n-hi-IN is earlier than 0:4.0.3.3.26-0.10.1 AND libreoffice-l10n-hu is earlier than 0:4.0.3.3.26-0.10.1 AND libreoffice-l10n-it is earlier than 0:4.0.3.3.26-0.10.1 AND libreoffice-l10n-ja is earlier than 0:4.0.3.3.26-0.10.1 AND libreoffice-l10n-ko is earlier than 0:4.0.3.3.26-0.10.1 AND libreoffice-l10n-nb is earlier than 0:4.0.3.3.26-0.10.1 AND libreoffice-l10n-nl is earlier than 0:4.0.3.3.26-0.10.1 AND libreoffice-l10n-nn is earlier than 0:4.0.3.3.26-0.10.1 AND libreoffice-l10n-pl is earlier than 0:4.0.3.3.26-0.10.1 AND libreoffice-l10n-pt is earlier than 0:4.0.3.3.26-0.10.1 AND libreoffice-l10n-pt-BR is earlier than 0:4.0.3.3.26-0.10.1 AND libreoffice-l10n-ru is earlier than 0:4.0.3.3.26-0.10.1 AND libreoffice-l10n-sk is earlier than 0:4.0.3.3.26-0.10.1 AND libreoffice-l10n-sv is earlier than 0:4.0.3.3.26-0.10.1 AND libreoffice-l10n-xh is earlier than 0:4.0.3.3.26-0.10.1 AND libreoffice-l10n-zh-CN is earlier than 0:4.0.3.3.26-0.10.1 AND libreoffice-l10n-zh-TW is earlier than 0:4.0.3.3.26-0.10.1 AND libreoffice-l10n-zu is earlier than 0:4.0.3.3.26-0.10.1

CPE : Common Platform Enumeration

Type	Description	Count
Application	Libreoffice cpe:2.3:a:libreoffice:libreoffice:4.3.2:::::::* cpe:2.3:a:libreoffice:libreoffice:4.3.1:::::::* cpe:2.3:a:libreoffice:libreoffice:4.3.0:::::::* cpe:2.3:a:libreoffice:libreoffice:4.2.6:::::::* cpe:2.3:a:libreoffice:libreoffice:4.2.5:::::::* cpe:2.3:a:libreoffice:libreoffice:4.2.4:::::::* cpe:2.3:a:libreoffice:libreoffice:4.2.3:::::::* cpe:2.3:a:libreoffice:libreoffice:4.2.2:::::::* cpe:2.3:a:libreoffice:libreoffice:4.2.1:::::::* cpe:2.3:a:libreoffice:libreoffice:4.2.0:::::::* cpe:2.3:a:libreoffice:libreoffice:4.1.4:::::::* cpe:2.3:a:libreoffice:libreoffice:4.1.3:::::::* cpe:2.3:a:libreoffice:libreoffice:4.1.2:::::::* cpe:2.3:a:libreoffice:libreoffice:4.1.1:::::::* cpe:2.3:a:libreoffice:libreoffice:4.1.0:::::::* cpe:2.3:a:libreoffice:libreoffice:4.0.4.2:::::::* cpe:2.3:a:libreoffice:libreoffice:4.0.3.3:::::::* cpe:2.3:a:libreoffice:libreoffice:4.0.3:::::::* cpe:2.3:a:libreoffice:libreoffice:4.0.2:::::::* cpe:2.3:a:libreoffice:libreoffice:4.0.1:::::::* cpe:2.3:a:libreoffice:libreoffice:4.0.0:::::::*	21
Os	Canonical Ubuntu Linux cpe:2.3:o:canonical:ubuntu_linux:14.10:::::::* cpe:2.3:o:canonical:ubuntu_linux:14.04::::lts:::	2
Os	Opensuse cpe:2.3:o:opensuse:opensuse:13.1:::::::*	1
Os	Redhat Enterprise Linux Desktop cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:::::::*	1
Os	Redhat Enterprise Linux Server cpe:2.3:o:redhat:enterprise_linux_server:7.0:::::::*	1
Os	Redhat Enterprise Linux Workstation cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:::::::*	1

Snort® IPS/IDS

Date	Description
2015-08-18	LibreOffice Impress socket manager Use After Free attempt RuleID : 35253 - Revision : 3 - Type : SERVER-OTHER

Nessus® Vulnerability Scanner

Date	Description
2016-03-10	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201603-05.nasl - Type : ACT_GATHER_INFO
2016-02-29	Name : The remote openSUSE host is missing a security update. File : openSUSE-2016-273.nasl - Type : ACT_GATHER_INFO
2015-03-26	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20150305_libreoffice_on_SL7_x.nasl - Type : ACT_GATHER_INFO
2015-03-18	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2015-0377.nasl - Type : ACT_GATHER_INFO
2015-03-13	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2015-0377.nasl - Type : ACT_GATHER_INFO
2015-03-05	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2015-0377.nasl - Type : ACT_GATHER_INFO
2014-12-17	Name : The remote host contains an application that is affected by a use-after-free ... File : libreoffice_427.nasl - Type : ACT_GATHER_INFO
2014-12-17	Name : The remote host contains an application that is affected by a use-after-free ... File : libreoffice_433.nasl - Type : ACT_GATHER_INFO
2014-12-03	Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_libreoffice-2014-11-19-141120.nasl - Type : ACT_GATHER_INFO
2014-11-19	Name : The remote openSUSE host is missing a security update. File : openSUSE-2014-682.nasl - Type : ACT_GATHER_INFO
2014-11-17	Name : The remote openSUSE host is missing a security update. File : openSUSE-2014-661.nasl - Type : ACT_GATHER_INFO
2014-11-06	Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-2398-1.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

Source	Url
BID	http://www.securityfocus.com/bid/71351
CONFIRM	https://www.libreoffice.org/about-us/security/advisories/CVE-2014-3693/
GENTOO	https://security.gentoo.org/glsa/201603-05
REDHAT	http://rhn.redhat.com/errata/RHSA-2015-0377.html
SECUNIA	http://secunia.com/advisories/62111 http://secunia.com/advisories/62132 http://secunia.com/advisories/62396
SUSE	http://lists.opensuse.org/opensuse-updates/2014-11/msg00049.html
UBUNTU	http://www.ubuntu.com/usn/USN-2398-1

Alert History

If you want to see full details history, please login or register.

Date	Informations
2023-02-13 05:28:16	Multiple Updates
2023-02-03 00:28:30	Multiple Updates
2021-05-04 12:32:29	Multiple Updates
2021-04-22 01:39:35	Multiple Updates
2020-05-23 00:41:12	Multiple Updates
2018-10-31 00:20:38	Multiple Updates
2018-01-26 12:05:35	Multiple Updates
2016-12-03 09:23:57	Multiple Updates
2016-11-29 00:24:55	Multiple Updates
2016-08-31 21:26:08	Multiple Updates
2016-03-11 13:26:30	Multiple Updates
2016-03-01 13:26:32	Multiple Updates
2015-08-18 21:27:31	Multiple Updates
2015-03-27 13:28:18	Multiple Updates
2015-03-21 00:26:00	Multiple Updates
2015-03-20 00:25:54	Multiple Updates
2015-03-19 13:28:06	Multiple Updates
2015-03-18 09:27:02	Multiple Updates
2015-03-14 13:25:29	Multiple Updates
2015-03-06 13:25:49	Multiple Updates
2015-01-01 00:22:26	Multiple Updates
2014-12-24 09:23:30	Multiple Updates
2014-12-18 13:25:34	Multiple Updates
2014-12-04 13:28:00	Multiple Updates
2014-11-21 13:25:04	Multiple Updates
2014-11-20 09:23:15	Multiple Updates
2014-11-18 13:26:08	Multiple Updates
2014-11-10 17:23:29	Multiple Updates
2014-11-08 00:24:06	First insertion

Global Informations

Type	Count
Oval ID(s)	3
CPE ID(s)	27
Sources(s)	9
Snort® Rule(s)	1
Nessus® Exploit(s)	12

	Related
10	RHSA-2015:0377
9.3	GLSA-201603-05
7.5	USN-2398-1
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 3 more Alert(s)

7.5 - CVE-2014-3693

Executive Summary

Security-Database Scoring CVSS v3

Security-Database Scoring CVSS v2

Detail

Original Source

OVAL Definitions

CPE : Common Platform Enumeration

Snort® IPS/IDS

Nessus® Vulnerability Scanner

Sources (Detail)

Alert History

Global Informations

Open Standards

Other Databases

COMPANY

STANDARDS

RECENT POSTS

MENU