You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@openoffice.apache.org by Herbert Duerr <hd...@apache.org> on 2014/08/21 15:01:32 UTC
CVE-2014-3524: Apache OpenOffice Calc Command Injection Vulnerability
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
CVE-2014-3524
OpenOffice Calc Command Injection Vulnerability
Severity: Important
Vendor: The Apache Software Foundation
Versions Affected:
Apache OpenOffice 4.1.0 and older on Windows.
OpenOffice.org versions may also be affected.
Description:
The vulnerability allows command injection when loading Calc spreadsheets. Specially crafted documents can be used for command-injection attacks. Further exploits are possible but have not been verified.
Mitigation:
Apache OpenOffice users are advised to upgrade to Apache OpenOffice 4.1.1. Users who are unable to upgrade immediately should be cautious when opening untrusted documents.
Credits:
The Apache OpenOffice security team credits Rohan Durve and James Kettle of Context Information Security as the discoverer of this flaw.
Herbert Dürr
Member of the Apache OpenOffice Security Team
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (Cygwin)
iQIcBAEBAgAGBQJT9e2fAAoJEDfnuKc+PLjJNT0P/1kg+qHwcuqDScV2HdOHbIP3
409ABpECFSLsAf4S6EwpBTeSBQoBCco+uyzMPJ9yOO6xcDdcuq2BF6vdBLL46UKC
WP+yy4G4BBAX/NnE+mTVT2Tc+JgwJJ6Zzd03JuIQo4T0qnsnYjfG7fAY9fx4vTc5
TAvFEakG8Nrrvoq5s856aKZdRlM5JMsUPzFd1JtsWopWmyRWHd9dNwJZJAmTr68F
3QeBONe9SKK1nb9TxQt5W4MUbraw6doN6q5bDa8eDJUiwzGraMqdCBTD2tVe09BF
Mi2TM6lJc4D27aZ8vMxZJTMWRGNGSU9fAuZYNmndXCYGk3rjKB6ghEfxK2DjaG5b
KuXAg6jg8Q+9CZNL769h1NIavj+Yhs7ouiFgS5gkb0l8oeU/UiCcmqq5y0cTzT43
Bu/5VYLj4dNq2XwwMLY7lzQeJ4xKS8WLmBEJ43v3Pocha5f020dftgH0D+sV3V8C
7Rn33gPrf5Ff/klGcvEUOkCRRalKI72CAN7c8AkPlNwWb4OhIQboSNRHF1jHm8Kb
mifIsECKudk8cKbKkiRuP9Eaq+nfZp/WswvmPboRuMdTLuT4vwGUTXzL7If8XDb6
a2a3Mc4Mr5unYVJLG3lS+VkozjQOVjjDwy8FuiZg/To/bsmZ5s+vURwHH8EGkUFN
N3jdeIXCa76iNNKuVPHF
=Ku0Y
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@openoffice.apache.org
For additional commands, e-mail: dev-help@openoffice.apache.org
Re: CVE-2014-3524: Apache OpenOffice Calc Command Injection Vulnerability
Posted by Jennifer Quinton Chelley <je...@gmail.com>.
Thanks. Will upgrade to 4.1.1
On 21 August 2014 14:01, Herbert Duerr <hd...@apache.org> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> CVE-2014-3524
> OpenOffice Calc Command Injection Vulnerability
>
> Severity: Important
> Vendor: The Apache Software Foundation
>
> Versions Affected:
> Apache OpenOffice 4.1.0 and older on Windows.
> OpenOffice.org versions may also be affected.
>
> Description:
> The vulnerability allows command injection when loading Calc
> spreadsheets. Specially crafted documents can be used for command-injection
> attacks. Further exploits are possible but have not been verified.
>
> Mitigation:
> Apache OpenOffice users are advised to upgrade to Apache
> OpenOffice 4.1.1. Users who are unable to upgrade immediately should be
> cautious when opening untrusted documents.
>
> Credits:
> The Apache OpenOffice security team credits Rohan Durve and James
> Kettle of Context Information Security as the discoverer of this flaw.
>
> Herbert Dürr
> Member of the Apache OpenOffice Security Team
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.13 (Cygwin)
>
> iQIcBAEBAgAGBQJT9e2fAAoJEDfnuKc+PLjJNT0P/1kg+qHwcuqDScV2HdOHbIP3
> 409ABpECFSLsAf4S6EwpBTeSBQoBCco+uyzMPJ9yOO6xcDdcuq2BF6vdBLL46UKC
> WP+yy4G4BBAX/NnE+mTVT2Tc+JgwJJ6Zzd03JuIQo4T0qnsnYjfG7fAY9fx4vTc5
> TAvFEakG8Nrrvoq5s856aKZdRlM5JMsUPzFd1JtsWopWmyRWHd9dNwJZJAmTr68F
> 3QeBONe9SKK1nb9TxQt5W4MUbraw6doN6q5bDa8eDJUiwzGraMqdCBTD2tVe09BF
> Mi2TM6lJc4D27aZ8vMxZJTMWRGNGSU9fAuZYNmndXCYGk3rjKB6ghEfxK2DjaG5b
> KuXAg6jg8Q+9CZNL769h1NIavj+Yhs7ouiFgS5gkb0l8oeU/UiCcmqq5y0cTzT43
> Bu/5VYLj4dNq2XwwMLY7lzQeJ4xKS8WLmBEJ43v3Pocha5f020dftgH0D+sV3V8C
> 7Rn33gPrf5Ff/klGcvEUOkCRRalKI72CAN7c8AkPlNwWb4OhIQboSNRHF1jHm8Kb
> mifIsECKudk8cKbKkiRuP9Eaq+nfZp/WswvmPboRuMdTLuT4vwGUTXzL7If8XDb6
> a2a3Mc4Mr5unYVJLG3lS+VkozjQOVjjDwy8FuiZg/To/bsmZ5s+vURwHH8EGkUFN
> N3jdeIXCa76iNNKuVPHF
> =Ku0Y
> -----END PGP SIGNATURE-----
>
Re: CVE-2014-3524: Apache OpenOffice Calc Command Injection Vulnerability
Posted by rebecca beuchert <re...@gmail.com>.
Unsubscribe
On Thu, Aug 21, 2014 at 9:03 AM Herbert Duerr <hd...@apache.org> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> CVE-2014-3524
> OpenOffice Calc Command Injection Vulnerability
>
> Severity: Important
> Vendor: The Apache Software Foundation
>
> Versions Affected:
> Apache OpenOffice 4.1.0 and older on Windows.
> OpenOffice.org versions may also be affected.
>
> Description:
> The vulnerability allows command injection when loading Calc
> spreadsheets. Specially crafted documents can be used for command-injection
> attacks. Further exploits are possible but have not been verified.
>
> Mitigation:
> Apache OpenOffice users are advised to upgrade to Apache
> OpenOffice 4.1.1. Users who are unable to upgrade immediately should be
> cautious when opening untrusted documents.
>
> Credits:
> The Apache OpenOffice security team credits Rohan Durve and James
> Kettle of Context Information Security as the discoverer of this flaw.
>
> Herbert Dürr
> Member of the Apache OpenOffice Security Team
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.13 (Cygwin)
>
> iQIcBAEBAgAGBQJT9e2fAAoJEDfnuKc+PLjJNT0P/1kg+qHwcuqDScV2HdOHbIP3
> 409ABpECFSLsAf4S6EwpBTeSBQoBCco+uyzMPJ9yOO6xcDdcuq2BF6vdBLL46UKC
> WP+yy4G4BBAX/NnE+mTVT2Tc+JgwJJ6Zzd03JuIQo4T0qnsnYjfG7fAY9fx4vTc5
> TAvFEakG8Nrrvoq5s856aKZdRlM5JMsUPzFd1JtsWopWmyRWHd9dNwJZJAmTr68F
> 3QeBONe9SKK1nb9TxQt5W4MUbraw6doN6q5bDa8eDJUiwzGraMqdCBTD2tVe09BF
> Mi2TM6lJc4D27aZ8vMxZJTMWRGNGSU9fAuZYNmndXCYGk3rjKB6ghEfxK2DjaG5b
> KuXAg6jg8Q+9CZNL769h1NIavj+Yhs7ouiFgS5gkb0l8oeU/UiCcmqq5y0cTzT43
> Bu/5VYLj4dNq2XwwMLY7lzQeJ4xKS8WLmBEJ43v3Pocha5f020dftgH0D+sV3V8C
> 7Rn33gPrf5Ff/klGcvEUOkCRRalKI72CAN7c8AkPlNwWb4OhIQboSNRHF1jHm8Kb
> mifIsECKudk8cKbKkiRuP9Eaq+nfZp/WswvmPboRuMdTLuT4vwGUTXzL7If8XDb6
> a2a3Mc4Mr5unYVJLG3lS+VkozjQOVjjDwy8FuiZg/To/bsmZ5s+vURwHH8EGkUFN
> N3jdeIXCa76iNNKuVPHF
> =Ku0Y
> -----END PGP SIGNATURE-----
>