CVE-2015-5214

21

FAUCET Score

CVE-2015-5214 is a denial-of-service and arbitrary code execution vulnerability affecting LibreOffice before 4.4.6 and 5.x before 5.0.1, and Apache OpenOffice before 4.1.2. The vulnerability, rated with a CVSS score of 6.8, allows remote attackers to trigger memory corruption and application crashes or execute arbitrary code by exploiting a non-existent bookmark index in a DOC file. While the EPSS score is relatively high, indicating potential exploitability, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		12.04CPE matchmatch criteria	cpe:2.3:o:canonical:ubuntu_linux:12.04::::lts:::
		14.04CPE matchmatch criteria	cpe:2.3:o:canonical:ubuntu_linux:14.04::::lts:::
		15.04CPE matchmatch criteria	cpe:2.3:o:canonical:ubuntu_linux:15.04:::::::*
		7.0CPE matchmatch criteria	cpe:2.3:o:debian:debian_linux:7.0:::::::*
		8.0CPE matchmatch criteria	cpe:2.3:o:debian:debian_linux:8.0:::::::*

CVSS Data

CVSS version used by this source: 2.0

6.8MEDIUM

AV:N/AC:M/Au:N/C:P/I:P/A:P

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Exploitability Score

8.6

Impact Score

6.4

CvssVersion

2.0

Exploit Intelligence

EPSS Score

9.55%

Probability of exploitation in next 30 days

EPSS Percentile

94.9%

Percentile rank of EPSS score among Peer Group

As of 2026-07-27

Model: v2026.06.15

This CVE's current EPSS score of 0.0955 is in the 94th percentile among its peer group of 19,958 CVEs.

Social Chatter

No social media mentions found for this CVE.

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (9)

asteriskpatch availablevia llm_extracted

Fixed in: 4.4.6/5.0.1

check_pointpatch availablevia llm_extracted

Fixed in: 4.4.6/5.0.1

denopatch availablevia llm_extracted

Fixed in: 4.1.2

libreofficepatch availablevia llm_extracted

Fixed in: 4.1.2

nessuspatch availablevia llm_extracted

Fixed in: 4.1.2

postgresqlpatch availablevia llm_extracted

Fixed in: 4.1.2

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: libreoffice-1:4.3.7.2-5.el7_2.1

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 6Fixed in: libreoffice-1:4.2.8.2-11.el6_7.1

redhatend of lifevia redhat_api

Product: Red Hat Enterprise Linux 5Fixed in: openoffice.org

Vendor Advisories (7)

redhatCVE-2015-5214Moderate

libreoffice: Bookmarks in DOC documents are insufficiently checked causing memory corruption

asteriskllm-asterisk-b07ee2144e25ab06

DOC Bookmark Status Memory Corruption

check_pointllm-check_point-7a7612fbf1978f05

DOC Bookmark Status Memory Corruption

denollm-deno-c2f25dd3c9ee24e7

.DOC Bookmarks Vulnerability

postgresqlllm-postgresql-092296a7e2670a1c

.DOC Bookmarks Vulnerability

libreofficellm-libreoffice-08f5cbe066c039e8

.DOC Bookmarks Vulnerability

nessusllm-nessus-f3ceb0a3b586f5f8

.DOC Bookmarks Vulnerability

References

rhn.redhat.com / errata/RHSA-2015-2619.html

security.gentoo.org / glsa/201603-05

security.gentoo.org / glsa/201611-03

debian.org / security/2015/dsa-3394

libreoffice.org / about-us/security/advisories/cve-2015-5214

Vendor Advisory

openoffice.org / security/cves/CVE-2015-5214.html

Vendor Advisory

oracle.com / technetwork/topics/security/linuxbulletinoct2015-2719645.html

securityfocus.com / bid/77486

securitytracker.com / id/1034086

securitytracker.com / id/1034091

ubuntu.com / usn/USN-2793-1