Unscored severity · published Apr 28, 2015
CVE-2015-1774
The HWP filter in LibreOffice before 4.3.7 and 4.4.x before 4.4.2 and Apache OpenOffice before 4.1.2 allows remote attackers to cause a denial of service (crash) or possibly…
–
CVSS
7.6%
EPSS
No
On KEV
Description
The HWP filter in LibreOffice before 4.3.7 and 4.4.x before 4.4.2 and Apache OpenOffice before 4.1.2 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted HWP document, which triggers an out-of-bounds write.
Exploitation
Is it being used?
Exploit prediction (EPSS)7.6% · higher than 95% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DL
Debian Linux · Debian
7.0; 8.0 · source: NVD
EL
Enterprise Linux Desktop · Redhat
6.0 · source: NVD
EL
Enterprise Linux Server · Redhat
6.0 · source: NVD
EL
Enterprise Linux Workstation · Redhat
6.0 · source: NVD
FE
Fedora · Fedoraproject
21 · source: NVD
LI
Libreoffice · Libreoffice
through 4.3.6; 4.4.0; 4.4.1 · source: NVD
OP
Openoffice · Apache
through 4.1.1 · source: NVD
UL
Ubuntu Linux · Canonical
12.04; 14.04; 14.10 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-1774
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-1774
Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156582.html
Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157550.html
Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2015-05/msg00015.html
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-1458.html
Third Party Advisory
http://www.debian.org/security/2015/dsa-3236
Vendor Advisory
http://www.openoffice.org/security/cves/CVE-2015-1774.html
More from Openoffice
8.8
CVE-2023-47804
Apache OpenOffice documents can contain links that call internal macros with arbitrary arguments
8.8
CVE-2022-37401
Apache OpenOffice supports the storage of passwords for web connections in the user's configuration database
8.8
CVE-2022-37400
Apache OpenOffice supports the storage of passwords for web connections in the user's configuration database
8.8
CVE-2021-30245
The project received a report that all versions of Apache OpenOffice through 4.1.8 can open non-http(s) hyperlinks
8.1
CVE-2025-64403
Apache OpenOffice Calc spreadsheet can contain links to other files, in the form of "external data sources"