ISOMAN

CVE

CVE-2018-10119

sot/source/sdstor/stgstrms.cxx in LibreOffice before 5.4.5.1 and 6.x before 6.0.1.1 uses an incorrect integer data type in the StgSmallStrm class, which allows remote attackers to cause a denial of service (use-after-free with write access) or possibly have unspecified other impact via a crafted document that uses the structured storage ole2 wrapper file format.

Severity
HIGH
CVSS
7.8
Published
Modified
NVD detailAll CVEs

Linked Releases

DistributionReleaseStatusEvidence
Ubuntu16.04.7 amd64 desktopunknownsource
Ubuntu16.04.6 i386 desktopunknownsource
Ubuntu16.04.7 amd64 serverunknownsource
Ubuntu16.04.6 i386 serverunknownsource
Ubuntu14.04.6 amd64 desktopunknownsource
Ubuntu14.04.6 i386 desktopunknownsource
Ubuntu14.04.6 amd64 serverunknownsource
Ubuntu14.04.6 i386 serverunknownsource

References

  1. https://access.redhat.com/errata/RHSA-2018:3054
  2. https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5747
  3. https://gerrit.libreoffice.org/#/c/48751/
  4. https://gerrit.libreoffice.org/#/c/48756/
  5. https://gerrit.libreoffice.org/#/c/48757/
  6. https://gerrit.libreoffice.org/#/c/48758/
  7. https://gerrit.libreoffice.org/gitweb?p=core.git%3Ba=commit%3Bh=fdd41c995d1f719e92c6f083e780226114762f05
  8. https://lists.debian.org/debian-lts-announce/2018/04/msg00021.html
  9. https://usn.ubuntu.com/3883-1/
  10. https://www.debian.org/security/2018/dsa-4178
  11. https://www.libreoffice.org/about-us/security/advisories/cve-2018-10119/
  12. https://access.redhat.com/errata/RHSA-2018:3054
  13. https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5747
  14. https://gerrit.libreoffice.org/#/c/48751/
  15. https://gerrit.libreoffice.org/#/c/48756/
  16. https://gerrit.libreoffice.org/#/c/48757/
  17. https://gerrit.libreoffice.org/#/c/48758/
  18. https://gerrit.libreoffice.org/gitweb?p=core.git%3Ba=commit%3Bh=fdd41c995d1f719e92c6f083e780226114762f05
  19. https://lists.debian.org/debian-lts-announce/2018/04/msg00021.html
  20. https://usn.ubuntu.com/3883-1/