Fixed in AOO 4.1.2: CVE-2015-5214 .DOC Bookmarks Vulnerability
Republished without change. This advisory, originally posted
on 2015-11-04, died in a moderation queue and did not reach
the list. The [hidden email] is the official
mailing list for Apache OpenOffice security advisories, as
specified at <http://www.openoffice.org/security/alerts.html>.
This republication ensures preservation in the announce-list
archive. This is the final advisory to be reposted.
A crafted Microsoft Word DOC can contain invalid bookmark
positions leading to memory corruption when the document is
loaded or bookmarks are manipulated. The defect allows an
attacker to cause denial of service (memory corruption and
application crash) and possible execution of arbitrary code.
There are no known exploits of this vulnerability.
A proof-of-concept demonstration exists.
Vendor: The Apache Software Foundation
All Apache OpenOffice versions 4.1.1 and older are affected.
OpenOffice.org versions are also affected.
Apache OpenOffice users are urged to download and install Apache
OpenOffice version 4.1.2 or later. The defect is over-ridden
Users who do not upgrade to Apache OpenOffice 4.1.2 should
be careful of .DOC files from unknown or unreliable sources.
A Microsoft Word 97-2003 DOC format file can be checked
by opening with software, such as Microsoft Office Word or
Word Online. The documents may be rejected as corrupted or
extraordinary employment of bookmarks may be observable.