7.5 - USN-2398-1

Executive Summary

Summary
Title	LibreOffice vulnerability

Informations
Name	USN-2398-1	First vendor Publication	2014-11-05
Vendor	Ubuntu	Last vendor Modification	2014-11-05
Severity (Vendor)	N/A	Revision	N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Cvss Base Score	7.5	Attack Range	Network
Cvss Impact Score	6.4	Attack Complexity	Low
Cvss Expoit Score	10	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 14.10 - Ubuntu 14.04 LTS

Summary:

LibreOffice could be made to crash or run programs if it received specially crafted network traffic.

Software Description: - libreoffice: Office productivity suite

Details:

It was discovered that LibreOffice incorrectly handled the Impress remote control port. An attacker could possibly use this issue to cause Impress to crash, resulting in a denial of service, or possibly execute arbitrary code.

Update instructions:

The problem can be corrected by updating your system to the following package versions:

Ubuntu 14.10:
libreoffice-core 1:4.3.3-0ubuntu1

Ubuntu 14.04 LTS:
libreoffice-core 1:4.2.7-0ubuntu1

This update uses a new upstream release, which includes additional bug fixes. After a standard system update you need to restart LibreOffice to make all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-2398-1
CVE-2014-3693

Package Information:
https://launchpad.net/ubuntu/+source/libreoffice/1:4.3.3-0ubuntu1
https://launchpad.net/ubuntu/+source/libreoffice/1:4.2.7-0ubuntu1

Original Source

Url : http://www.ubuntu.com/usn/USN-2398-1

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:27595

Oval ID:	oval:org.mitre.oval:def:27595
Title:	USN-2398-1 -- LibreOffice vulnerability
Description:	It was discovered that LibreOffice incorrectly handled the Impress remote control port. An attacker could possibly use this issue to cause Impress to crash, resulting in a denial of service, or possibly execute arbitrary code.
Family:	unix	Class:	patch
Reference(s):	USN-2398-1 CVE-2014-3693	Version:	5
Platform(s):	Ubuntu 14.10 Ubuntu 14.04	Product(s):	libreoffice
Definition Synopsis:
Ubuntu 14.10 release section Ubuntu 14.10 is installed AND libreoffice-core is earlier than 1:4.3.3-0ubuntu1 AND Ubuntu 14.04 release section Ubuntu 14.04 is installed AND libreoffice-core is earlier than 1:4.2.7-0ubuntu1

Definition Id: oval:org.mitre.oval:def:28363

Oval ID:	oval:org.mitre.oval:def:28363
Title:	SUSE-SU-2014:1494-1 -- Security update for libreoffice (moderate)
Description:	libreoffice was updated to version 4.3.3.2 to fix two security issues: These security issues were fixed: - "Document as E-mail" vulnerability (bnc#900218). - Impress remote control use-after-free vulnerability (CVE-2014-3693). Various other fixes are included in the update.
Family:	unix	Class:	patch
Reference(s):	SUSE-SU-2014:1494-1 CVE-2014-3693	Version:	3
Platform(s):	SUSE Linux Enterprise Desktop 12	Product(s):	libreoffice
Definition Synopsis:
SUSE Linux Enterprise Desktop 12 is installed Packages match section libreoffice is earlier than 0:4.3.3.2-6.1 AND libreoffice-base is earlier than 0:4.3.3.2-6.1 AND libreoffice-base-debuginfo is earlier than 0:4.3.3.2-6.1 AND libreoffice-base-drivers-mysql is earlier than 0:4.3.3.2-6.1 AND libreoffice-base-drivers-mysql-debuginfo is earlier than 0:4.3.3.2-6.1 AND libreoffice-base-drivers-postgresql is earlier than 0:4.3.3.2-6.1 AND libreoffice-base-drivers-postgresql-debuginfo is earlier than 0:4.3.3.2-6.1 AND libreoffice-calc is earlier than 0:4.3.3.2-6.1 AND libreoffice-calc-debuginfo is earlier than 0:4.3.3.2-6.1 AND libreoffice-calc-extensions is earlier than 0:4.3.3.2-6.1 AND libreoffice-debuginfo is earlier than 0:4.3.3.2-6.1 AND libreoffice-debugsource is earlier than 0:4.3.3.2-6.1 AND libreoffice-draw is earlier than 0:4.3.3.2-6.1 AND libreoffice-draw-debuginfo is earlier than 0:4.3.3.2-6.1 AND libreoffice-filters-optional is earlier than 0:4.3.3.2-6.1 AND libreoffice-gnome is earlier than 0:4.3.3.2-6.1 AND libreoffice-gnome-debuginfo is earlier than 0:4.3.3.2-6.1 AND libreoffice-impress is earlier than 0:4.3.3.2-6.1 AND libreoffice-impress-debuginfo is earlier than 0:4.3.3.2-6.1 AND libreoffice-mailmerge is earlier than 0:4.3.3.2-6.1 AND libreoffice-math is earlier than 0:4.3.3.2-6.1 AND libreoffice-math-debuginfo is earlier than 0:4.3.3.2-6.1 AND libreoffice-officebean is earlier than 0:4.3.3.2-6.1 AND libreoffice-officebean-debuginfo is earlier than 0:4.3.3.2-6.1 AND libreoffice-pyuno is earlier than 0:4.3.3.2-6.1 AND libreoffice-pyuno-debuginfo is earlier than 0:4.3.3.2-6.1 AND libreoffice-writer is earlier than 0:4.3.3.2-6.1 AND libreoffice-writer-debuginfo is earlier than 0:4.3.3.2-6.1 AND libreoffice-writer-extensions is earlier than 0:4.3.3.2-6.1 AND libreoffice-icon-theme-tango is earlier than 0:4.3.3.2-6.1 AND libreoffice-l10n-af is earlier than 0:4.3.3.2-6.1 AND libreoffice-l10n-ar is earlier than 0:4.3.3.2-6.1 AND libreoffice-l10n-ca is earlier than 0:4.3.3.2-6.1 AND libreoffice-l10n-cs is earlier than 0:4.3.3.2-6.1 AND libreoffice-l10n-da is earlier than 0:4.3.3.2-6.1 AND libreoffice-l10n-de is earlier than 0:4.3.3.2-6.1 AND libreoffice-l10n-en is earlier than 0:4.3.3.2-6.1 AND libreoffice-l10n-es is earlier than 0:4.3.3.2-6.1 AND libreoffice-l10n-fi is earlier than 0:4.3.3.2-6.1 AND libreoffice-l10n-fr is earlier than 0:4.3.3.2-6.1 AND libreoffice-l10n-gu is earlier than 0:4.3.3.2-6.1 AND libreoffice-l10n-hi is earlier than 0:4.3.3.2-6.1 AND libreoffice-l10n-hu is earlier than 0:4.3.3.2-6.1 AND libreoffice-l10n-it is earlier than 0:4.3.3.2-6.1 AND libreoffice-l10n-ja is earlier than 0:4.3.3.2-6.1 AND libreoffice-l10n-ko is earlier than 0:4.3.3.2-6.1 AND libreoffice-l10n-nb is earlier than 0:4.3.3.2-6.1 AND libreoffice-l10n-nl is earlier than 0:4.3.3.2-6.1 AND libreoffice-l10n-nn is earlier than 0:4.3.3.2-6.1 AND libreoffice-l10n-pl is earlier than 0:4.3.3.2-6.1 AND libreoffice-l10n-pt-BR is earlier than 0:4.3.3.2-6.1 AND libreoffice-l10n-pt-PT is earlier than 0:4.3.3.2-6.1 AND libreoffice-l10n-ru is earlier than 0:4.3.3.2-6.1 AND libreoffice-l10n-sk is earlier than 0:4.3.3.2-6.1 AND libreoffice-l10n-sv is earlier than 0:4.3.3.2-6.1 AND libreoffice-l10n-xh is earlier than 0:4.3.3.2-6.1 AND libreoffice-l10n-zh-Hans is earlier than 0:4.3.3.2-6.1 AND libreoffice-l10n-zh-Hant is earlier than 0:4.3.3.2-6.1 AND libreoffice-l10n-zu is earlier than 0:4.3.3.2-6.1

Definition Id: oval:org.mitre.oval:def:28472

Oval ID:	oval:org.mitre.oval:def:28472
Title:	SUSE-SU-2014:1544-1 -- Security update for LibreOffice (moderate)
Description:	LibreOffice was updated to fix two security issues. These security issues have been fixed: * "Document as E-mail" vulnerability (bnc#900218). * Impress remote control use-after-free vulnerability (CVE-2014-3693). Security Issues: * CVE-2014-3693 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3693>
Family:	unix	Class:	patch
Reference(s):	SUSE-SU-2014:1544-1 CVE-2014-3693	Version:	3
Platform(s):	SUSE Linux Enterprise Desktop 11	Product(s):	LibreOffice
Definition Synopsis:
SUSE Linux Enterprise Desktop 11.x is installed Packages match section libreoffice is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-base is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-base-drivers-postgresql is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-base-extensions is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-calc is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-calc-extensions is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-draw is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-draw-extensions is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-filters-optional is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-gnome is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-impress is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-impress-extensions is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-kde is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-kde4 is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-mailmerge is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-math is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-mono is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-officebean is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-pyuno is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-writer is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-writer-extensions is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-help-cs is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-help-da is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-help-de is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-help-en-GB is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-help-en-US is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-help-es is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-help-fr is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-help-gu-IN is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-help-hi-IN is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-help-hu is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-help-it is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-help-ja is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-help-ko is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-help-nl is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-help-pl is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-help-pt is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-help-pt-BR is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-help-ru is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-help-sv is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-help-zh-CN is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-help-zh-TW is earlier than 0:4.0.3.3.26-0.10.2 AND libreoffice-icon-themes is earlier than 0:4.0.3.3.26-0.10.1 AND libreoffice-l10n-af is earlier than 0:4.0.3.3.26-0.10.1 AND libreoffice-l10n-ar is earlier than 0:4.0.3.3.26-0.10.1 AND libreoffice-l10n-ca is earlier than 0:4.0.3.3.26-0.10.1 AND libreoffice-l10n-cs is earlier than 0:4.0.3.3.26-0.10.1 AND libreoffice-l10n-da is earlier than 0:4.0.3.3.26-0.10.1 AND libreoffice-l10n-de is earlier than 0:4.0.3.3.26-0.10.1 AND libreoffice-l10n-en-GB is earlier than 0:4.0.3.3.26-0.10.1 AND libreoffice-l10n-es is earlier than 0:4.0.3.3.26-0.10.1 AND libreoffice-l10n-fi is earlier than 0:4.0.3.3.26-0.10.1 AND libreoffice-l10n-fr is earlier than 0:4.0.3.3.26-0.10.1 AND libreoffice-l10n-gu-IN is earlier than 0:4.0.3.3.26-0.10.1 AND libreoffice-l10n-hi-IN is earlier than 0:4.0.3.3.26-0.10.1 AND libreoffice-l10n-hu is earlier than 0:4.0.3.3.26-0.10.1 AND libreoffice-l10n-it is earlier than 0:4.0.3.3.26-0.10.1 AND libreoffice-l10n-ja is earlier than 0:4.0.3.3.26-0.10.1 AND libreoffice-l10n-ko is earlier than 0:4.0.3.3.26-0.10.1 AND libreoffice-l10n-nb is earlier than 0:4.0.3.3.26-0.10.1 AND libreoffice-l10n-nl is earlier than 0:4.0.3.3.26-0.10.1 AND libreoffice-l10n-nn is earlier than 0:4.0.3.3.26-0.10.1 AND libreoffice-l10n-pl is earlier than 0:4.0.3.3.26-0.10.1 AND libreoffice-l10n-pt is earlier than 0:4.0.3.3.26-0.10.1 AND libreoffice-l10n-pt-BR is earlier than 0:4.0.3.3.26-0.10.1 AND libreoffice-l10n-ru is earlier than 0:4.0.3.3.26-0.10.1 AND libreoffice-l10n-sk is earlier than 0:4.0.3.3.26-0.10.1 AND libreoffice-l10n-sv is earlier than 0:4.0.3.3.26-0.10.1 AND libreoffice-l10n-xh is earlier than 0:4.0.3.3.26-0.10.1 AND libreoffice-l10n-zh-CN is earlier than 0:4.0.3.3.26-0.10.1 AND libreoffice-l10n-zh-TW is earlier than 0:4.0.3.3.26-0.10.1 AND libreoffice-l10n-zu is earlier than 0:4.0.3.3.26-0.10.1

CPE : Common Platform Enumeration

Type	Description	Count
Application	Libreoffice cpe:2.3:a:libreoffice:libreoffice:4.3.2:::::::* cpe:2.3:a:libreoffice:libreoffice:4.3.1:::::::* cpe:2.3:a:libreoffice:libreoffice:4.3.0:::::::* cpe:2.3:a:libreoffice:libreoffice:4.2.6:::::::* cpe:2.3:a:libreoffice:libreoffice:4.2.5:::::::* cpe:2.3:a:libreoffice:libreoffice:4.2.4:::::::* cpe:2.3:a:libreoffice:libreoffice:4.2.3:::::::* cpe:2.3:a:libreoffice:libreoffice:4.2.2:::::::* cpe:2.3:a:libreoffice:libreoffice:4.2.1:::::::* cpe:2.3:a:libreoffice:libreoffice:4.2.0:::::::* cpe:2.3:a:libreoffice:libreoffice:4.1.4:::::::* cpe:2.3:a:libreoffice:libreoffice:4.1.3:::::::* cpe:2.3:a:libreoffice:libreoffice:4.1.2:::::::* cpe:2.3:a:libreoffice:libreoffice:4.1.1:::::::* cpe:2.3:a:libreoffice:libreoffice:4.1.0:::::::* cpe:2.3:a:libreoffice:libreoffice:4.0.4.2:::::::* cpe:2.3:a:libreoffice:libreoffice:4.0.3.3:::::::* cpe:2.3:a:libreoffice:libreoffice:4.0.3:::::::* cpe:2.3:a:libreoffice:libreoffice:4.0.2:::::::* cpe:2.3:a:libreoffice:libreoffice:4.0.1:::::::* cpe:2.3:a:libreoffice:libreoffice:4.0.0:::::::*	21
Os	Canonical Ubuntu Linux cpe:2.3:o:canonical:ubuntu_linux:14.10:::::::* cpe:2.3:o:canonical:ubuntu_linux:14.04::::lts:::	2
Os	Opensuse cpe:2.3:o:opensuse:opensuse:13.1:::::::*	1
Os	Redhat Enterprise Linux Desktop cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:::::::*	1
Os	Redhat Enterprise Linux Server cpe:2.3:o:redhat:enterprise_linux_server:7.0:::::::*	1
Os	Redhat Enterprise Linux Workstation cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:::::::*	1

Snort® IPS/IDS

Date	Description
2015-08-18	LibreOffice Impress socket manager Use After Free attempt RuleID : 35253 - Revision : 3 - Type : SERVER-OTHER

Nessus® Vulnerability Scanner

Date	Description
2016-03-10	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201603-05.nasl - Type : ACT_GATHER_INFO
2016-02-29	Name : The remote openSUSE host is missing a security update. File : openSUSE-2016-273.nasl - Type : ACT_GATHER_INFO
2015-03-26	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20150305_libreoffice_on_SL7_x.nasl - Type : ACT_GATHER_INFO
2015-03-18	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2015-0377.nasl - Type : ACT_GATHER_INFO
2015-03-13	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2015-0377.nasl - Type : ACT_GATHER_INFO
2015-03-05	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2015-0377.nasl - Type : ACT_GATHER_INFO
2014-12-17	Name : The remote host contains an application that is affected by a use-after-free ... File : libreoffice_427.nasl - Type : ACT_GATHER_INFO
2014-12-17	Name : The remote host contains an application that is affected by a use-after-free ... File : libreoffice_433.nasl - Type : ACT_GATHER_INFO
2014-12-03	Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_libreoffice-2014-11-19-141120.nasl - Type : ACT_GATHER_INFO
2014-11-19	Name : The remote openSUSE host is missing a security update. File : openSUSE-2014-682.nasl - Type : ACT_GATHER_INFO
2014-11-17	Name : The remote openSUSE host is missing a security update. File : openSUSE-2014-661.nasl - Type : ACT_GATHER_INFO
2014-11-06	Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-2398-1.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.

Date	Informations
2014-11-10 17:26:49	Multiple Updates
2014-11-08 00:27:40	Multiple Updates
2014-11-07 13:26:29	Multiple Updates
2014-11-05 21:23:54	First insertion

Global Informations

Type	Count
Oval ID(s)	3
CPE ID(s)	27
Snort® Rule(s)	1
Nessus® Exploit(s)	12

	Related
7.5	CVE-2014-3693
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 1 more Alert(s)

7.5 - USN-2398-1

Executive Summary

Security-Database Scoring CVSS v3

Security-Database Scoring CVSS v2

Detail

Original Source

OVAL Definitions

CPE : Common Platform Enumeration

Snort® IPS/IDS

Nessus® Vulnerability Scanner

Alert History

Global Informations

Open Standards

Other Databases

COMPANY

STANDARDS

RECENT POSTS

MENU