{"id":"CVE-2014-3524","aliases":["EUVD-2014-3523","GHSA-7h2p-mc8p-mxwq","UBUNTU-CVE-2014-3524","USN-2331-1","openSUSE-SU-2024:10006-1"],"status":"published","title":"Apache OpenOffice before 4.1.1 allows remote attackers to execute arbitrary commands and possibly...","description":"Apache OpenOffice before 4.1.1 allows remote attackers to execute arbitrary commands and possibly have other unspecified impact via a crafted Calc spreadsheet.","severity":{"version":"2.0","score":9.3,"vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.14109,"percentile":0.96589,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-77"],"published":"2014-08-26T00:00:00Z","modified":"2026-06-17T00:08:23Z","fixes":[{"ecosystem":"Ubuntu:14.04:LTS","package":"libreoffice","fixed_in":["1:4.2.6.3-0ubuntu1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2.6.3-0ubuntu1"}]}],"versions":["1:4.1.2~rc3-0ubuntu1","1:4.1.2~rc3-0ubuntu2","1:4.1.3-0ubuntu2","1:4.1.3-0ubuntu3","1:4.2.0~rc4-0ubuntu1","1:4.2.0-0ubuntu1","1:4.2.1-0ubuntu1","1:4.2.3~rc2-0ubuntu1","1:4.2.3~rc3-0ubuntu1","1:4.2.3~rc3-0ubuntu2","1:4.2.4-0ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2.6.3-0ubuntu1"}]}],"versions":["1:4.1.2~rc3-0ubuntu1","1:4.1.2~rc3-0ubuntu2","1:4.1.3-0ubuntu2","1:4.1.3-0ubuntu3","1:4.2.0~rc4-0ubuntu1","1:4.2.0-0ubuntu1","1:4.2.1-0ubuntu1","1:4.2.3~rc2-0ubuntu1","1:4.2.3~rc3-0ubuntu1","1:4.2.3~rc3-0ubuntu2","1:4.2.4-0ubuntu2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.3.3-2.2"}]}],"bundled":17}],"products":[{"vendor":"apache","product":"openoffice"},{"vendor":"libreoffice","product":"libreoffice"}],"references":[{"url":"http://www.securityfocus.com/bid/69351","tags":["vdb-entry","x_refsource_BID","x_transferred","Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://secunia.com/advisories/60235","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link"]},{"url":"http://blog.documentfoundation.org/2014/08/28/libreoffice-4-3-1-fresh-announced/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"http://www.securityfocus.com/archive/1/533200/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/95421","tags":["vdb-entry","x_refsource_XF","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1030755","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Broken Link","Third Party Advisory","VDB Entry","report"]},{"url":"http://secunia.com/advisories/59877","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link"]},{"url":"http://www.openoffice.org/security/cves/CVE-2014-3524.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"https://security.gentoo.org/glsa/201603-05","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory"]},{"url":"http://secunia.com/advisories/59600","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3524"},{"url":"http://blog.documentfoundation.org/2014/08/28/libreoffice-4-3-1-fresh-announced"},{"url":"https://github.com/advisories/GHSA-7h2p-mc8p-mxwq"},{"url":"https://ubuntu.com/security/CVE-2014-3524","tags":["report"]},{"url":"http://xforce.iss.net/xforce/xfdb/95421","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2331-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-3524","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2010-2935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-2936","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0247","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3524","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3575","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3693","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8146","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8147","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9093","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4551","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-45513","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5212","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5213","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5214","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0794","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0795","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4324","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2014-3524","description":"Apache OpenOffice before 4.1.1 allows remote attackers to execute arbitrary commands and possibly have other unspecified impact via a crafted Calc spreadsheet.","status":"published","published":"2014-08-26T14:00:00Z","modified":"2024-08-06T10:50:16.81Z","updated_at":"2026-11-02T14:33:44.569327Z"}],"euvd":[{"id":"EUVD-2014-3523","description":"Apache OpenOffice before 4.1.1 allows remote attackers to execute arbitrary commands and possibly have other unspecified impact via a crafted Calc spreadsheet.","status":"published","published":"2014-08-26T14:00:00Z","modified":"2024-08-06T10:50:16Z","updated_at":"2026-11-03T01:57:10.446744Z"}],"ghsa":[{"id":"GHSA-7h2p-mc8p-mxwq","title":"Apache OpenOffice before 4.1.1 allows remote attackers to execute arbitrary commands and possibly...","description":"Apache OpenOffice before 4.1.1 allows remote attackers to execute arbitrary commands and possibly have other unspecified impact via a crafted Calc spreadsheet.","status":"published","published":"2022-05-13T01:03:57Z","modified":"2025-04-12T12:37:55Z","cwes":["CWE-77"],"updated_at":"2026-11-02T15:01:18.41255Z"}],"nvd":[{"id":"CVE-2014-3524","description":"Apache OpenOffice before 4.1.1 allows remote attackers to execute arbitrary commands and possibly have other unspecified impact via a crafted Calc spreadsheet.","status":"published","published":"2014-08-26T14:55:05.923Z","modified":"2026-06-17T00:08:23.31Z","cvss":[{"version":"2.0","score":9.3,"vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:02:55.19899Z"}],"osv":[{"id":"openSUSE-SU-2024:10006-1","title":"libreoffice-5.2.3.3-2.2 on GA media","description":"These are all security issues fixed in the libreoffice-5.2.3.3-2.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:27:04.490196Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"UBUNTU-CVE-2014-3524","description":"Apache OpenOffice before 4.1.1 allows remote attackers to execute arbitrary commands and possibly have other unspecified impact via a crafted Calc spreadsheet.","status":"published","published":"2014-08-26T00:00:00Z","modified":"2026-04-22T09:39:45.117883Z","updated_at":"2026-11-02T15:54:09.010095Z"},{"id":"USN-2331-1","title":"libreoffice vulnerability","description":"Rohan Durve and James Kettle discovered LibreOffice Calc sometimes allowed\nfor command injection when opening spreadsheets. If a user were tricked\ninto opening a crafted Calc spreadsheet, an attacker could exploit this to\nrun programs as your login.\n","status":"published","published":"2014-09-02T17:49:15Z","modified":"2026-04-22T08:58:43.044677Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}