CVE-2015-4551

Name	CVE-2015-4551
Description	LibreOffice before 4.4.5 and Apache OpenOffice before 4.1.2 uses the stored LinkUpdateMode configuration information in OpenDocument Format files and templates when handling links, which might allow remote attackers to obtain sensitive information via a crafted document, which embeds data from local files into (1) Calc or (2) Writer.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DSA-3394-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libreoffice (PTS)	bullseye (security), bullseye	1:7.0.4-4+deb11u9	fixed
	bookworm	4:7.4.7-1+deb12u3	fixed
	bookworm (security)	4:7.4.7-1+deb12u2	fixed
	sid, trixie	4:24.2.5-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
libreoffice	source	wheezy	1:3.5.4+dfsg2-0+deb7u5	DSA-3394-1
libreoffice	source	jessie	1:4.3.3-2+deb8u2	DSA-3394-1
libreoffice	source	(unstable)	1:5.0.1~rc1-1

https://www.libreoffice.org/about-us/security/advisories/cve-2015-4551/