What’s Vulnerable › Vulnerabilities

CVE-2014-3575

• Severity: medium (CVSS 4.3 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 11.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2014-08-27 · updated 2026-06-17
• Weakness: CWE-200

Description

The OLE preview generation in Apache OpenOffice before 4.1.1 and OpenOffice.org (OOo) might allow remote attackers to embed arbitrary data into documents via crafted OLE objects.

Affected products

• Apache Software Foundation Apache OpenOffice: before 4.1.1 — fixed in 4.1.1
• The Document Foundation LibreOffice: before 4.2.6; from 4.3.0 before 4.3.1 — fixed in 4.2.6, 4.3.1
• RedHat Enterprise Linux Desktop: 7.0
• RedHat Enterprise Linux Server: 7.0
• RedHat Enterprise Linux Workstation: 7.0

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache OpenOffice 4.1.1; The Document Foundation LibreOffice 4.2.6, 4.3.1. Check the vendor advisory for mitigations.

References

• http://archives.neohapsis.com/archives/bugtraq/2014-08/0115.html
• http://blog.documentfoundation.org/2014/08/28/libreoffice-4-3-1-fresh-announced/
• http://lists.fedoraproject.org/pipermail/package-announce/2014-September/137657.html
• http://rhn.redhat.com/errata/RHSA-2015-0377.html
• http://secunia.com/advisories/59600
• http://secunia.com/advisories/59877
• http://www.openoffice.org/security/cves/CVE-2014-3575.html
• http://www.securityfocus.com/bid/69354
• http://www.securitytracker.com/id/1030754
• https://exchange.xforce.ibmcloud.com/vulnerabilities/95420
• https://security.gentoo.org/glsa/201603-05
• http://archives.neohapsis.com/archives/bugtraq/2014-08/0115.html

Get alerted when CVE-2014-3575 or the next vulnerability affects your stack