CVE-2015-5213

Exploitation likely. EPSS gives it a 9.6% chance of exploitation in the next 30 days. A vendor fix is available.

CVSS 2.06.8Medium EPSS percentile95th9.6% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2015-11-10Updated 2026-05-06Sources: CVE.org, NVD, BDU

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Apache OpenofficeAffected: ≤ 4.1.1Upgrade to: after 4.1.1Stated by: NVD
LibreofficeAffected: ≤ 4.4.4Upgrade to: after 4.4.4Stated by: NVD
Canonical Ltd. UbuntuAffected: 15.04Upgrade to: not statedStated by: BDU
Сообщество свободного программного обеспечения Debian GNU/LinuxAffected: 7Upgrade to: not statedStated by: BDU
The Document Foundation LibreOfficeAffected: до 4.4.4 включительноUpgrade to: not statedStated by: BDU

Versions as the sources state them. 1 more product has version data. Full version matrix after sign-in

Steps

Written by AI from the record

Check which version of LibreOffice or Apache OpenOffice is installed on your office computers.
If it's LibreOffice older than 4.4.5, update to 4.4.5 or a later version.
If it's Apache OpenOffice older than 4.1.2, update to 4.1.2 or a later version.
Avoid opening DOC files from unknown or unexpected senders until updated.
Ask your IT provider to confirm all staff machines have been upgraded.

Vendor advisory Some work to apply

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Integer overflow in LibreOffice before 4.4.5 and Apache OpenOffice before 4.1.2 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a long DOC file, which triggers a buffer overflow.

In plain language

Written by AI from the record

An old flaw in LibreOffice and Apache OpenOffice could crash the program or possibly let an attacker run malicious code via a rigged Word document, but there's no sign anyone is actually exploiting it, so it's worth fixing on a normal schedule rather than an emergency.

Integer overflow (CWE-189) in DOC file parsing in LibreOffice before 4.4.5 and Apache OpenOffice before 4.1.2 triggers a buffer overflow that can crash the application or potentially enable arbitrary code execution when a crafted document is opened.

If you're affected

Application crash / downtime
Possible malware execution on employee PC
Document-based phishing vector
Data loss from unsaved work

What is it

This is a weakness in the part of the office software that reads old-style Word documents (.doc files). If someone sends a specially crafted document, opening it could make the program crash, similar to a booby-trapped letter that jams a shredder — and in the worst case it could let the attacker slip in unwanted instructions along with the jam.

Who is affected

This matters to you if your business uses LibreOffice or Apache OpenOffice to open or edit .doc Word documents, including on Ubuntu, Debian, or Astra Linux systems. It's only a risk if someone on your team opens a malicious DOC file sent by an attacker — there's no need to expose anything to the internet for this to trigger.

How urgent is it

This should be treated as a moderate priority: there's no confirmed exploitation in the wild and no public exploit code available, so attackers aren't actively using this today. Press attention is rising, but that reflects news coverage, not actual attacks, so plan an update rather than treating this as an emergency.

What to do — in detail

Confirm exposure by checking installed versions across all endpoints: LibreOffice builds prior to 4.4.5 and Apache OpenOffice builds prior to 4.1.2 are vulnerable. Upgrade LibreOffice to 4.4.5 or later and Apache OpenOffice to 4.1.2 or later; these are maintenance releases with no major breaking changes expected for typical document workflows, but test macro-heavy documents after upgrading. On Debian/Ubuntu/Astra Linux, apply the distribution's security advisory packages rather than manual builds where available. If immediate patching isn't possible, mitigate by restricting DOC file handling (e.g., disabling automatic opening of email attachments, using a sandboxed viewer, or converting untrusted DOC files to a safer format via a server-side converter before opening locally). No CISA KEV listing exists, so there is no federal remediation deadline. Monitor vendor advisories (LibreOffice and OpenOffice security pages) for any update to exploitation status, and watch EPSS trend (currently falling) for signs of renewed attacker interest.

Technical context

CVSS 6.8 (Medium, AV:N/AC:M/Au:N/C:P/I:P/A:P) reflects remote, no-authentication attack vector with medium complexity and partial impact to confidentiality, integrity, and availability. Weakness type is CWE-189 (integer overflow) leading to a buffer overflow during parsing of long DOC files. Not present in CISA's Known Exploited Vulnerabilities catalog, and no public exploit code is on record. EPSS places predicted exploitation likelihood in a low-moderate band (95th percentile) with a falling trend, consistent with aging, well-patched software and no active campaign. Exploit maturity is theoretical/PoC-absent; press attention is rising but should not be read as evidence of in-the-wild exploitation.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.