LibreOffice and OpenOffice automatically open embedded content

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - LibreOffice and OpenOffice automatically open embedded content (CVE-2012-5639)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Apache OpenOffice installed on the remote host is a version prior to 4.1.15. It is, therefore, affected by multiple vulnerabilities as stated in the vendor advisories and release notes.

  - Apache OpenOffice documents can contain links that call internal macros with arbitrary     arguments. Several URI Schemes are defined for this purpose. Links can be activated by     clicks, or by automatic document events. The execution of such links must be subject     to user approval. In the affected versions of Apache OpenOffice, approval for certain     links is not requested; when activated, such links could therefore result in arbitrary     script execution. This is a corner case of 2022-47502. (CVE-2023-47804)

  - An attacker can craft an OBD containing a 'database/script' file with a SCRIPT command     where the contents of the file could be written to a new file whose location was determined     by the attacker. (CVE-2023-1183)

  - In Apache OpenOffice and LibreOffice embedded content will be opened automatically without     that a warning is shown. (CVE-2012-5639)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
217796	Linux Distros Unpatched Vulnerability : CVE-2012-5639	Nessus	Misc.	medium
187659	Apache OpenOffice < 4.1.15 Multiple Vulnerabilities	Nessus	Windows	high
187658	Apache OpenOffice < 4.1.15 Multiple Vulnerabilities (macOS)	Nessus	MacOS X Local Security Checks	high

Detections

Analytics

CVE-2012-5639

medium

Tenable Plugins

medium

high

high