SB2019020631 - Ubuntu update for libreoffice
Published: February 6, 2019 Updated: October 30, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 5 vulnerabilities.
1) Use-after-free error (CVE-ID: CVE-2018-10119)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to writ arbitrary files and cause DoS condition on the target system.
The weakness exists in sot/source/sdstor/stgstrms.cxx due to using an incorrect integer data type in the StgSmallStrm class. A remote attacker can submit a specially crafted document that uses the structured storage ole2 wrapper file format, trigger use-after-free error with write access and cause the service to crash.
2) Heap-based buffer overflow (CVE-ID: CVE-2018-10120)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to write arbitrary files and cause DoS condition on the target system.
The weakness exists in read function in sw/source/filter/ww8/ww8toolbar.cxx due to improper validation of a customizations index. A remote attacker can submit a specially crafted document that contains a certain Microsoft Word record, trigger heap-based buffer overflow with write access and cause the service to crash.
3) Information disclosure (CVE-ID: CVE-2018-10583)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.
The weakness exists due to automatic processing and initiating of an SMB connection embedded in a malicious file. A remote attacker can trick the victim into opening a specially crafted file and gain access to potentially sensitive information.
4) Buffer overflow (CVE-ID: CVE-2018-11790)
CWE-ID: CWE-120 - Buffer overflow
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing malicious input. A remote attacker can trick the victim into opening a specially crafted file with OpenOffice, trigger buffer overflow and execute arbitrary code with elevated privileges.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
5) Path traversal (CVE-ID: CVE-2018-16858) Exploited
CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform directory traversal attacks.
The vulnerability exists due to input validation error. A remote attacker can trick the victim into opening a specially crafted Office file, conduct path traversal attack and execute a python method from a script in any arbitrary file system location
Remediation
Install update from vendor's website.