#VU84853 Insufficient UI Warning of Dangerous Operations in OpenOffice - CVE-2012-5639
Published: December 29, 2023
Vulnerability identifier: #VU84853
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2012-5639
CWE-ID: CWE-357
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
OpenOffice
OpenOffice
Software vendor:
Apache Foundation
Apache Foundation
Description
The vulnerability allows a remote attacker to impact document integrity.
The vulnerability exists due to a missing warning when loading internal and external resources. A remote attacker can create a specially crafted file, trick the victim into opening it and impact document integrity, leading to information disclosure.
Remediation
Install updates from vendor's website.
External links
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-5639
- http://www.openwall.com/lists/oss-security/2012/12/14/1
- https://access.redhat.com/security/cve/cve-2012-5639
- https://security-tracker.debian.org/tracker/CVE-2012-5639
- https://lists.apache.org/thread.html/r253f92d0e6511d07a79774002e1d9db1d20b24bff27914a5adb14ccb%40%3Cissues.openoffice.apache.org%3E
- http://www.openwall.com/lists/oss-security/2023/12/28/6
- https://cwiki.apache.org/confluence/display/OOOUSERS/AOO+4.1.15+Release+Notes