Main Vulnerability Database SB2017022202

SB2017022202 - Arbitrary file disclosure in LibreOffice

Published: February 22, 2017

Security Bulletin ID SB2017022202

Severity

Low

Patch available

YES

Number of vulnerabilities 1

Exploitation vector Remote access

Highest impact Information disclosure

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 1 security vulnerability.

1) Arbitrary file disclosure (CVE-ID: CVE-2017-3157)

The vulnerability allows a remote attacker to obtain potentially sensitive information.

The vulnerability exists within calc and write functionality of LibreOffice when processing embedded objects during preview of files. A remote attacker can create a specially crafted document, linked to an existing file on victims system, trick the victim into opening the document, saving it and sending back to the attacker.

Successful exploitation of the vulnerability may allow an attacker to view contents of arbitrary files on the system.

Remediation

Install update from vendor's website.

References

http://www.libreoffice.org/about-us/security/advisories/cve-2017-3157/