Buffer overflow in LibreOffice - CVE-2016-0794
Published: February 18, 2016 / Updated: July 28, 2020
Vulnerability identifier: #VU32333
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2016-0794
CWE-ID: CWE-119
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: LibreOffice
Affected software:
LibreOffice
LibreOffice
Detailed vulnerability description
The vulnerability allows a local non-authenticated attacker to execute arbitrary code.
The lwp filter in LibreOffice before 5.0.4 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted LotusWordPro (lwp) document.
How to mitigate CVE-2016-0794
Install update from vendor's website.
Sources
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178036.html
- http://lists.opensuse.org/opensuse-updates/2016-05/msg00110.html
- http://lists.opensuse.org/opensuse-updates/2016-07/msg00050.html
- http://rhn.redhat.com/errata/RHSA-2016-2579.html
- http://www.debian.org/security/2016/dsa-3482
- http://www.securitytracker.com/id/1035022
- http://www.ubuntu.com/usn/USN-2899-1
- https://www.libreoffice.org/about-us/security/advisories/cve-2016-0794/
- https://www.verisign.com/en_US/security-services/security-intelligence/vulnerability-reports/articles/index.xhtml?id=1220
- https://www.verisign.com/en_US/security-services/security-intelligence/vulnerability-reports/articles/index.xhtml?id=1221
- https://www.verisign.com/en_US/security-services/security-intelligence/vulnerability-reports/articles/index.xhtml?id=1222