Advisories » MGASA-2014-0446

Updated libreoffice packages fix security vulnerability

Publication date: 14 Nov 2014
Modification date: 14 Nov 2014
Type: security
Affected Mageia releases : 3
CVE: CVE-2014-3575

Description

A vulnerability in LibreOffice allows an attacker to send a document which
when opened will trigger the prompt to "Update Links" but if the user cancels
that prompt may still generate and insert into the document an OLE2 preview
image of a file on the victims filesystem, Data exposure is possible if the
updated document is then distributed to other parties (CVE-2014-3575).

LibreOffice has been patched to fix this issue.
                

References

• https://bugs.mageia.org/show_bug.cgi?id=13580
• http://www.libreoffice.org/about-us/security/advisories/cve-2014-3575/
• https://lists.fedoraproject.org/pipermail/package-announce/2014-September/137657.html
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3575

SRPMS

3/core

• libreoffice-4.0.6.2-3.mga3