CVE-2014-0247
critical
CVSS v3
—
CVSS v2
10.0
VIR risk
10.0
Description
LibreOffice 4.2.4 executes unspecified VBA macros automatically, which has unspecified impact and attack vectors, possibly related to doc/docmacromode.cxx.
Predictions
Exploit likelihood
20%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2014-0247
Vendor advisory: secalert@redhat.com — https://www.libreoffice.org/about-us/security/advisories/cve-2014-0247/
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| debian | bookworm | fixed | 1:4.2.5-1 |
| debian | bullseye | fixed | 1:4.2.5-1 |
| debian | forky | fixed | 1:4.2.5-1 |
| debian | sid | fixed | 1:4.2.5-1 |
| debian | trixie | fixed | 1:4.2.5-1 |
| suse | 13.1 | affected | |
| fedora | 19 | affected | |
| ubuntu | 14.04 | affected | |
| rhel | 7.0 | affected | |
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| libreoffice | libreoffice | 4.2.4 | |
References
- http://lists.fedoraproject.org/pipermail/package-announce/2014-July/135020.html
- http://lists.opensuse.org/opensuse-updates/2014-07/msg00006.html
- http://people.canonical.com/~ubuntu-security/cve/2014/CVE-2014-0247.html
- http://rhn.redhat.com/errata/RHSA-2015-0377.html
- http://secunia.com/advisories/57383
- http://secunia.com/advisories/59330
- http://secunia.com/advisories/60799
- http://www.gentoo.org/security/en/glsa/glsa-201408-19.xml
- http://www.securityfocus.com/bid/68151
- http://www.ubuntu.com/usn/USN-2253-1
- https://bugs.mageia.org/show_bug.cgi?id=13580
- https://gerrit.libreoffice.org/gitweb?p=core.git%3Ba=blobdiff%3Bf=sfx2/source/doc/docmacromode.cxx%3Bh=4d4ae52b4339582a039744d03671c1db0633d6c3%3Bhp=2108d1920f8148ff60fd4a57684f295d6d733e7b%3Bhb=1b0402f87c9b17fef2141130bfaa1798ece6ba0d%3Bhpb=4d2113250fa7ed62fe2c53ed0f76e3de5875cb81
- https://www.libreoffice.org/about-us/security/advisories/cve-2014-0247/
- https://security-tracker.debian.org/tracker/CVE-2014-0247
Verify integrity in audit chain (admin only). AS-IS.