CVE-2015-4551

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

LibreOffice before 4.4.5 and Apache OpenOffice before 4.1.2 uses the stored LinkUpdateMode configuration information in OpenDocument Format files and templates when handling links, which might allow remote attackers to obtain sensitive information via a crafted document, which embeds data from local files into (1) Calc or (2) Writer.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:P/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://rhn.redhat.com/errata/RHSA-2015-2619.htmlThird Party Advisory
http://www.debian.org/security/2015/dsa-3394Third Party Advisory
http://www.libreoffice.org/about-us/security/advisories/cve-2015-4551/Vendor Advisory
http://www.openoffice.org/security/cves/CVE-2015-4551.htmlVendor Advisory
http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.htmlThird Party Advisory
http://www.securityfocus.com/bid/77486Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1034085Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1034091Third Party Advisory, VDB Entry
http://www.ubuntu.com/usn/USN-2793-1Third Party Advisory
https://security.gentoo.org/glsa/201603-05Third Party Advisory
https://security.gentoo.org/glsa/201611-03Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-2619.htmlThird Party Advisory
http://www.debian.org/security/2015/dsa-3394Third Party Advisory
http://www.libreoffice.org/about-us/security/advisories/cve-2015-4551/Vendor Advisory
http://www.openoffice.org/security/cves/CVE-2015-4551.htmlVendor Advisory
http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.htmlThird Party Advisory
http://www.securityfocus.com/bid/77486Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1034085Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1034091Third Party Advisory, VDB Entry
http://www.ubuntu.com/usn/USN-2793-1Third Party Advisory
https://security.gentoo.org/glsa/201603-05Third Party Advisory
https://security.gentoo.org/glsa/201611-03Third Party Advisory

Timeline

Published: Nov 10, 2015
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-45524.3Cross-site scripting (XSS) vulnerability in the quick edit function in xmlhttp.php in MyBB (aka MyBulletinBoard) before 1.8.5 allows remote CVE-2015-45538.8A file upload issue exists in DeDeCMS before 5.7-sp1, which allows malicious users getshell.CVE-2015-45547.5Multiple unspecified vulnerabilities in TIBCO Spotfire Client and Spotfire Web Player Client in Spotfire Analyst before 5.5.2, 6.0.x before CVE-2015-45557.5Buffer overflow in the HTTP administrative interface in TIBCO Rendezvous before 8.4.4, Rendezvous Network Server before 1.1.1, Substation ES CVE-2015-45567.5The string-translate* procedure in the data-structures unit in CHICKEN before 4.10.0 allows remote attackers to cause a denial of service (c CVE-2015-45576.1Cross-site scripting (XSS) vulnerability in the new_Twitter_sign_button function in nextend-Twitter-connect.php in the Nextend Twitter Conne CVE-2015-45594.3Cross-site scripting (XSS) vulnerability in the product deployment feature in the Java core web services in Intel McAfee ePolicy Orchestrato CVE-2015-45826.1The TheCartPress boot-store (aka Boot Store) theme 1.6.4 for WordPress allows header.php tcp_register_error XSS. NOTE: CVE-2015-4582 is not CVE-2015-45866.8Cross-site request forgery (CSRF) vulnerability in Alcatel-Lucent CellPipe 7130 RG 5Ae.M2013 HOL with firmware 1.0.0.20h.HOL allows remote a CVE-2015-45874.3Cross-site scripting (XSS) vulnerability in the Alcatel-Lucent CellPipe 7130 router with firmware 1.0.0.20h.HOL allows remote attackers to i CVE-2015-45886.8Heap-based buffer overflow in the DecodeImage function in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (crash) or pos CVE-2015-45905.0The extractFrom function in Internals/QuotedString.cpp in Arduino JSON before 4.5 allows remote attackers to cause a denial of service (cras