Heap-based buffer overflow in LibreOffice - CVE-2018-10120

Vulnerability identifier: #VU12120

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-10120

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to write arbitrary files and cause DoS condition on the target system.

The weakness exists in read function in sw/source/filter/ww8/ww8toolbar.cxx due to improper validation of a customizations index. A remote attacker can submit a specially crafted document that contains a certain Microsoft Word record, trigger heap-based buffer overflow with write access and cause the service to crash.

LibreOffice
Debian Linux
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for Power
Ubuntu
Fedora
openSUSE Leap
libreoffice-core (Ubuntu package)
libreoffice

Update to versions 5.4.6.1 or 6.0.2.1.

libreoffice-core (Ubuntu package) - addressed in versions 1:4.2.8-0ubuntu5.5, 1:5.1.6~rc2-0ubuntu1~xenial6
libreoffice - update to 5.3.7.2-9.fc26

• https://www.libreoffice.org/about-us/security/advisories/cve-2018-10120/

• Debian update for libreoffice
• OpenSUSE Linux update for libreoffice
• Red Hat update for libreoffice
• Fedora 26 update for libreoffice
• Ubuntu update for libreoffice