The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The OLE preview generation in Apache OpenOffice before 4.1.1 and OpenOffice.org (OOo) might allow remote     attackers to embed arbitrary data into documents via crafted OLE objects. (CVE-2014-3575)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:0377 advisory.

    LibreOffice is an open source, community-developed office productivity     suite. It includes key desktop applications, such as a word processor, a     spreadsheet, a presentation manager, a formula editor, and a drawing     program. LibreOffice replaces OpenOffice and provides a similar but     enhanced and extended office suite.

    It was found that LibreOffice documents executed macros unconditionally,     without user approval, when these documents were opened using LibreOffice.
    An attacker could use this flaw to execute arbitrary code as the user     running LibreOffice by embedding malicious VBA scripts in the document as     macros. (CVE-2014-0247)

    A flaw was found in the OLE (Object Linking and Embedding) generation in     LibreOffice. An attacker could use this flaw to embed malicious OLE code in     a LibreOffice document, allowing for arbitrary code execution.
    (CVE-2014-3575)

    A use-after-free flaw was found in the Remote Control capabilities of the     LibreOffice Impress application. An attacker could use this flaw to     remotely execute code with the permissions of the user running LibreOffice     Impress. (CVE-2014-3693)

    The libreoffice packages have been upgraded to upstream version 4.2.6.3,     which provides a number of bug fixes and enhancements over the previous     version. Among others:

    * Improved OpenXML interoperability.

    * Additional statistic functions in Calc (for interoperability with Excel     and Excel's Add-in Analysis ToolPak).

    * Various performance improvements in Calc.

    * Apple Keynote and Abiword import.

    * Improved MathML export.

    * New Start screen with thumbnails of recently opened documents.

    * Visual clue in Slide Sorter when a slide has a transition or an     animation.

    * Improvements for trend lines in charts.

    * Support for BCP-47 language tags. (BZ#1119709)

    All libreoffice users are advised to upgrade to these updated packages,     which correct these issues and add these enhancements.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A version of LibreOffice is installed on the remote Windows host that is 4.x prior to 4.2.6-secfix (4.2.6.3). It is, therefore, affected by the following vulnerabilities :

  - An input-validation error exists related to handling     Calc spreadsheets that allows arbitrary command     execution. (CVE-2014-3524)

  - An input-validation error exists related to 'Update     Links' prompt handling that allows information     disclosure via improperly included OLE2 previews.
    (CVE-2014-3575)

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

Updated libreoffice packages that fix three security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a drawing program. LibreOffice replaces OpenOffice and provides a similar but enhanced and extended office suite.

It was found that LibreOffice documents executed macros unconditionally, without user approval, when these documents were opened using LibreOffice. An attacker could use this flaw to execute arbitrary code as the user running LibreOffice by embedding malicious VBA scripts in the document as macros. (CVE-2014-0247)

A flaw was found in the OLE (Object Linking and Embedding) generation in LibreOffice. An attacker could use this flaw to embed malicious OLE code in a LibreOffice document, allowing for arbitrary code execution.
(CVE-2014-3575)

A use-after-free flaw was found in the 'Remote Control' capabilities of the LibreOffice Impress application. An attacker could use this flaw to remotely execute code with the permissions of the user running LibreOffice Impress. (CVE-2014-3693)

The libreoffice packages have been upgraded to upstream version 4.2.6.3, which provides a number of bug fixes and enhancements over the previous version. Among others :

* Improved OpenXML interoperability.

* Additional statistic functions in Calc (for interoperability with Excel and Excel's Add-in 'Analysis ToolPak').

* Various performance improvements in Calc.

* Apple Keynote and Abiword import.

* Improved MathML export.

* New Start screen with thumbnails of recently opened documents.

* Visual clue in Slide Sorter when a slide has a transition or an animation.

* Improvements for trend lines in charts.

* Support for BCP-47 language tags. (BZ#1119709)

All libreoffice users are advised to upgrade to these updated packages, which correct these issues and add these enhancements.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
218251	Linux Distros Unpatched Vulnerability : CVE-2014-3575	Nessus	Misc.	2025/3/4	2025/9/3	high
81633	RHEL 7 : libreoffice (RHSA-2015:0377)	Nessus	Red Hat Local Security Checks	2015/3/5	2025/3/20	critical
80078	LibreOffice 4.x < 4.2.6-secfix (4.2.6.3) Multiple Vulnerabilities	Nessus	Windows	2014/12/17	2018/11/15	high
81892	CentOS 7 : libabw / libcmis / libetonyek / libfreehand / liblangtag / libmwaw / libodfgen / etc (CESA-2015:0377)	Nessus	CentOS Local Security Checks	2015/3/18	2021/1/4	critical

检测

插件搜索

high

critical

high

critical