The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2578-1 advisory.

    Alexander Cherepanov discovered that LibreOffice incorrectly handled certain RTF files. If a user were     tricked into opening a specially crafted RTF document, a remote attacker could cause LibreOffice to crash,     and possibly execute arbitrary code. (CVE-2014-9093)

    It was discovered that LibreOffice incorrectly handled certain HWP files. If a user were tricked into     opening a specially crafted HWP document, a remote attacker could cause LibreOffice to crash, and possibly     execute arbitrary code. (CVE-2015-1774)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Fix some .docx import crashes. And finally fix the re-render of checked->unchecked checkbox transition

update to 4.3.7

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

LibreOffice was updated to 4.3.7 to fix one security issue and a number of bugs.

The following vulnerability was fixed :

  - CVE-2015-1774: Specially crafted HWP documents could     have led to an application crash or possibly the     execution of arbitrary code (boo#919409)

The following non-security bugs were fixed :

  - boo#881214: Failed to launch reprots wizard in     libreoffice-base with error     'java.lang.NoClassDefFoundError'

In addition this update contains all upstream fixes of the 4.3.7 series.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2015:1458 advisory.

  - libreoffice: HWP file filter vulnerability (CVE-2015-1774)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

CVE-2015-1774: out-of-bounds write in HWP file filter

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update brings LibreOffice to version 5.0.2, a major version update.

It brings lots of new features, bugfixes and also security fixes.

Features as seen on http://www.libreoffice.org/discover/new-features/

  - LibreOffice 5.0 ships an impressive number of new     features for its spreadsheet module, Calc: complex     formulae image cropping, new functions, more powerful     conditional formatting, table addressing and much more.
    Calc's blend of performance and features makes it an     enterprise-ready, heavy duty spreadsheet application     capable of handling all kinds of workload for an     impressive range of use cases

  - New icons, major improvements to menus and sidebar : no     other LibreOffice version has looked that good and     helped you be creative and get things done the right     way. In addition, style management is now more intuitive     thanks to the visualization of styles right in the     interface.

  - LibreOffice 5 ships with numerous improvements to     document import and export filters for MS Office, PDF,     RTF, and more. You can now timestamp PDF documents     generated with LibreOffice and enjoy enhanced document     conversion fidelity all around.

The Pentaho Flow Reporting Engine is now added and used.

Security issues fixed :

  - CVE-2014-8146: The resolveImplicitLevels function in     common/ubidi.c in the Unicode Bidirectional Algorithm     implementation in ICU4C in International Components for     Unicode (ICU) before 55.1 did not properly track     directionally isolated pieces of text, which allowed     remote attackers to cause a denial of service     (heap-based buffer overflow) or possibly execute     arbitrary code via crafted text.

  - CVE-2014-8147: The resolveImplicitLevels function in     common/ubidi.c in the Unicode Bidirectional Algorithm     implementation in ICU4C in International Components for     Unicode (ICU) before 55.1 used an integer data type that     is inconsistent with a header file, which allowed remote     attackers to cause a denial of service (incorrect malloc     followed by invalid free) or possibly execute arbitrary     code via crafted text.

  - CVE-2015-4551: An arbitrary file disclosure     vulnerability in Libreoffice and Openoffice Calc and     Writer was fixed.

  - CVE-2015-1774: The HWP filter in LibreOffice allowed     remote attackers to cause a denial of service (crash) or     possibly execute arbitrary code via a crafted HWP     document, which triggered an out-of-bounds write.

  - CVE-2015-5212: A LibreOffice 'PrinterSetup Length'     integer underflow vulnerability could be used by     attackers supplying documents to execute code as the     user opening the document.

  - CVE-2015-5213: A LibreOffice 'Piece Table Counter'     invalid check design error vulnerability allowed     attackers supplying documents to execute code as the     user opening the document.

  - CVE-2015-5214: Multiple Vendor LibreOffice Bookmark     Status Memory Corruption Vulnerability allowed attackers     supplying documents to execute code as the user opening     the document.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
83110	Ubuntu 14.04 LTS : LibreOffice vulnerabilities (USN-2578-1)	Nessus	Ubuntu Local Security Checks	2015/4/28	2024/8/27	critical
83154	Fedora 21 : libreoffice-4.3.7.2-3.fc21 (2015-7022)	Nessus	Fedora Local Security Checks	2015/4/30	2021/1/11	medium
83396	openSUSE Security Update : libreoffice (openSUSE-2015-357)	Nessus	SuSE Local Security Checks	2015/5/13	2021/1/19	medium
84950	RHEL 6 : libreoffice (RHSA-2015:1458)	Nessus	Red Hat Local Security Checks	2015/7/23	2024/4/21	critical
83325	Fedora 20 : libreoffice-4.2.8.2-8.fc20 (2015-7213)	Nessus	Fedora Local Security Checks	2015/5/11	2021/1/11	medium
86757	SUSE SLED12 / SLES12 Security Update : Recommended update for LibreOffice (SUSE-SU-2015:1915-1)	Nessus	SuSE Local Security Checks	2015/11/5	2021/1/6	high

检测

插件搜索

critical

medium

medium

critical

medium

high