Unsubscribe On Thu, Aug 21, 2014 at 9:03 AM Herbert Duerr <h...@apache.org> wrote:
> -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > CVE-2014-3524 > OpenOffice Calc Command Injection Vulnerability > > Severity: Important > Vendor: The Apache Software Foundation > > Versions Affected: > Apache OpenOffice 4.1.0 and older on Windows. > OpenOffice.org versions may also be affected. > > Description: > The vulnerability allows command injection when loading Calc > spreadsheets. Specially crafted documents can be used for command-injection > attacks. Further exploits are possible but have not been verified. > > Mitigation: > Apache OpenOffice users are advised to upgrade to Apache > OpenOffice 4.1.1. Users who are unable to upgrade immediately should be > cautious when opening untrusted documents. > > Credits: > The Apache OpenOffice security team credits Rohan Durve and James > Kettle of Context Information Security as the discoverer of this flaw. > > Herbert Dürr > Member of the Apache OpenOffice Security Team > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.4.13 (Cygwin) > > iQIcBAEBAgAGBQJT9e2fAAoJEDfnuKc+PLjJNT0P/1kg+qHwcuqDScV2HdOHbIP3 > 409ABpECFSLsAf4S6EwpBTeSBQoBCco+uyzMPJ9yOO6xcDdcuq2BF6vdBLL46UKC > WP+yy4G4BBAX/NnE+mTVT2Tc+JgwJJ6Zzd03JuIQo4T0qnsnYjfG7fAY9fx4vTc5 > TAvFEakG8Nrrvoq5s856aKZdRlM5JMsUPzFd1JtsWopWmyRWHd9dNwJZJAmTr68F > 3QeBONe9SKK1nb9TxQt5W4MUbraw6doN6q5bDa8eDJUiwzGraMqdCBTD2tVe09BF > Mi2TM6lJc4D27aZ8vMxZJTMWRGNGSU9fAuZYNmndXCYGk3rjKB6ghEfxK2DjaG5b > KuXAg6jg8Q+9CZNL769h1NIavj+Yhs7ouiFgS5gkb0l8oeU/UiCcmqq5y0cTzT43 > Bu/5VYLj4dNq2XwwMLY7lzQeJ4xKS8WLmBEJ43v3Pocha5f020dftgH0D+sV3V8C > 7Rn33gPrf5Ff/klGcvEUOkCRRalKI72CAN7c8AkPlNwWb4OhIQboSNRHF1jHm8Kb > mifIsECKudk8cKbKkiRuP9Eaq+nfZp/WswvmPboRuMdTLuT4vwGUTXzL7If8XDb6 > a2a3Mc4Mr5unYVJLG3lS+VkozjQOVjjDwy8FuiZg/To/bsmZ5s+vURwHH8EGkUFN > N3jdeIXCa76iNNKuVPHF > =Ku0Y > -----END PGP SIGNATURE----- >
