CVE-2014-3524 : Apache OpenOffice before 4.1.1 allows remote attackers to execute arbitrary comm

Apache OpenOffice before 4.1.1 allows remote attackers to execute arbitrary commands and possibly have other unspecified impact via a crafted Calc spreadsheet.

Published 2014-08-26 14:55:06

Updated 2022-02-07 16:25:26

Source Red Hat, Inc.

View at NVD, CVE.org

Products affected by CVE-2014-3524

Apache » Openoffice
Versions before (<) 4.1.1
cpe:2.3:a:apache:openoffice:*:*:*:*:*:*:*:*
Matching versions
Libreoffice » Libreoffice
Versions from including (>=) 4.3.0 and before (<) 4.3.1
cpe:2.3:a:libreoffice:libreoffice:*:*:*:*:*:*:*:*
Matching versions
Libreoffice » Libreoffice
Versions before (<) 4.2.6
cpe:2.3:a:libreoffice:libreoffice:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2014-3524

EPSS FAQ

3.67%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 92 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2014-3524

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
9.3	HIGH	AV:N/AC:M/Au:N/C:C/I:C/A:C	8.6	10.0	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete

CWE ids for CVE-2014-3524

CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2014-3524

http://www.securityfocus.com/archive/1/533200/100/0/threaded

SecurityFocus
Broken Link;Third Party Advisory;VDB Entry
https://security.gentoo.org/glsa/201603-05

LibreOffice, OpenOffice: Multiple vulnerabilities (GLSA 201603-05) — Gentoo security
Third Party Advisory

CVEs referencing this url
http://blog.documentfoundation.org/2014/08/28/libreoffice-4-3-1-fresh-announced/

LibreOffice 4.3.1 "Fresh" announced - The Document Foundation Blog
Vendor Advisory

CVEs referencing this url
http://www.openoffice.org/security/cves/CVE-2014-3524.html

CVE-2014-3524
Vendor Advisory
http://www.securitytracker.com/id/1030755

Apache OpenOffice Calc Lets Remote Users Inject Commands - SecurityTracker
Broken Link;Third Party Advisory;VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/95421

Apache OpenOffice.org Calc command execution CVE-2014-3524 Vulnerability Report
Third Party Advisory;VDB Entry
http://www.securityfocus.com/bid/69351

Apache OpenOffice Calc CVE-2014-3524 Command Injection Vulnerability
Broken Link;Third Party Advisory;VDB Entry

Jump to

Vulnerability Details : CVE-2014-3524

Products affected by CVE-2014-3524

Exploit prediction scoring system (EPSS) score for CVE-2014-3524

CVSS scores for CVE-2014-3524

CWE ids for CVE-2014-3524

References for CVE-2014-3524