Description
Apache OpenOffice before 4.1.1 allows remote attackers to execute arbitrary commands and possibly have other unspecified impact via a crafted Calc spreadsheet.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | libreoffice | 1:4.2.6.3-0ubuntu1 | USN-2331-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | libreoffice | 5.2.3.3-2.2 | openSUSE-SU-2024:10006-1 |
Advisories 2
- USN-2331-1 libreoffice vulnerability Ubuntu Security Notices (USN) · Apr 22, 2026
- openSUSE-SU-2024:10006-1 libreoffice-5.2.3.3-2.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- 69351 vdb-entry
- 60235 third-party-advisory
- http://blog.documentfoundation.org/2014/08/28/libreoffice-4-3-1-fresh-announced/
- 20140821 CVE-2014-3524: Apache OpenOffice Calc Command Injection Vulnerability mailing-list
- apache-openoffice-cve20143524-command-exec(95421) vdb-entry
- 1030755 vdb-entry
- 59877 third-party-advisory
- http://www.openoffice.org/security/cves/CVE-2014-3524.html
- GLSA-201603-05 vendor-advisory
- 59600 third-party-advisory