CVE-2014-3693

What it actually does

Use-after-free in the Impress Remote socket manager allows memory corruption when processing a crafted request on TCP port 1599, resulting in denial of service or potential arbitrary code execution.

Why it matters to the business

Remote attackers could crash presentation software or execute code on affected systems, disrupting document workflows and requiring emergency patching on older LibreOffice deployments.

How an attack unfolds

An attacker connects to TCP port 1599 and sends a specially crafted request that triggers the use-after-free condition in the socket manager, leading to memory corruption that can be leveraged for code execution.

How to fix it

Upgrade LibreOffice to version 4.2.7 or 4.3.3 or later; disable Impress Remote feature if unused.

How to confirm the fix worked

Verify installed LibreOffice version is 4.2.7 or 4.3.3 or newer; confirm port 1599 is closed or the feature is disabled.

Typical attack path

1. Identify hosts listening on TCP port 1599 with Impress Remote enabled
2. Send crafted request to trigger use-after-free in socket manager
3. Exploit memory corruption to achieve denial of service or code execution

How to detect it

Inspect logs for connections to TCP port 1599, review LibreOffice crash reports mentioning the socket manager or Impress Remote, and search for unexpected process terminations after network activity on that port.

• TCP port 1599 connections
• LibreOffice crashes referencing Impress Remote socket manager

What your security team should do

• Apply updates to reach LibreOffice 4.2.7 or 4.3.3 immediately due to remote code execution risk
• Disable Impress Remote unless explicitly required
• Block or monitor inbound traffic to TCP port 1599