CVE-2017-3157
published 2017-11-20CVE-2017-3157: By exploiting the way Apache OpenOffice before 4.1.4 renders embedded objects, an attacker could craft a document that allows reading in a file from the user's…
PriorityP426medium5.5CVSS 3.0
AVLACLPRNUIRSUCHINAN
EPSS
3.12%
87.8th percentile
By exploiting the way Apache OpenOffice before 4.1.4 renders embedded objects, an attacker could craft a document that allows reading in a file from the user's filesystem. Information could be retrieved by the attacker by, e.g., using hidden sections to store the information, tricking the user into saving the document and convincing the user to send the document back to the attacker. The vulnerability is mitigated by the need for the attacker to know the precise file path in the target system, and the need to trick the user into saving the document and sending it back.
Affected
24 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | openoffice | <= 4.1.3 | — |
| apache_software_foundation | apache_openoffice | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | libreoffice | < libreoffice 1:5.2.3-1 (bookworm) | libreoffice 1:5.2.3-1 (bookworm) |
| libreoffice | libreoffice | >= 0 < 1:5.2.3-1 | 1:5.2.3-1 |
| libreoffice | libreoffice | >= 0 < 1:5.2.3-1 | 1:5.2.3-1 |
| libreoffice | libreoffice | >= 0 < 1:5.2.3-1 | 1:5.2.3-1 |
| libreoffice | libreoffice | >= 0 < 1:5.2.3-1 | 1:5.2.3-1 |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_server_aus | — | — |
| redhat | enterprise_linux_server_aus | — | — |
| redhat | enterprise_linux_server_aus | — | — |
| redhat | enterprise_linux_server_eus | — | — |
| redhat | enterprise_linux_server_eus | — | — |
| redhat | enterprise_linux_server_eus | — | — |
| redhat | enterprise_linux_server_eus | — | — |
| redhat | enterprise_linux_server_tus | — | — |
| redhat | enterprise_linux_server_tus | — | — |
| redhat | enterprise_linux_workstation | — | — |
| redhat | enterprise_linux_workstation | — | — |
CVSS provenance
nvdv3.05.5MEDIUMCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-c683-7wh2-j8m4: By exploiting the way Apache OpenOffice before 4
ghsa_unreviewed·2022-05-14
CVE-2017-3157 [MEDIUM] CWE-200 GHSA-c683-7wh2-j8m4: By exploiting the way Apache OpenOffice before 4
By exploiting the way Apache OpenOffice before 4.1.4 renders embedded objects, an attacker could craft a document that allows reading in a file from the user's filesystem. Information could be retrieved by the attacker by, e.g., using hidden sections to store the information, tricking the user into saving the document and convincing the user to send the document back to the attacker. The vulnerability is mitigated by the need for the attacker to know the precise file path in the target system, and the need to trick the user into saving the document and sending it back.
OSV
CVE-2017-3157: By exploiting the way Apache OpenOffice before 4
osv·2017-11-20·CVSS 5.5
CVE-2017-3157 [MEDIUM] CVE-2017-3157: By exploiting the way Apache OpenOffice before 4
By exploiting the way Apache OpenOffice before 4.1.4 renders embedded objects, an attacker could craft a document that allows reading in a file from the user's filesystem. Information could be retrieved by the attacker by, e.g., using hidden sections to store the information, tricking the user into saving the document and convincing the user to send the document back to the attacker. The vulnerability is mitigated by the need for the attacker to know the precise file path in the target system, and the need to trick the user into saving the document and sending it back.
Ubuntu
LibreOffice vulnerability
vendor_ubuntu·2017-02-23
CVE-2017-3157 LibreOffice vulnerability
Title: LibreOffice vulnerability
Summary: LibreOffice could be made to disclose files if it opened a specially crafted
file.
Ben Hayak discovered that it was possible to make LibreOffice Calc and Writer
disclose arbitrary files to an attacker if a user opened a specially crafted
file with embedded links.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
libreoffice: Arbitrary file disclosure in Calc and Writer
vendor_redhat·2017-02-22·CVSS 5.5
CVE-2017-3157 [MEDIUM] CWE-200 libreoffice: Arbitrary file disclosure in Calc and Writer
libreoffice: Arbitrary file disclosure in Calc and Writer
By exploiting the way Apache OpenOffice before 4.1.4 renders embedded objects, an attacker could craft a document that allows reading in a file from the user's filesystem. Information could be retrieved by the attacker by, e.g., using hidden sections to store the information, tricking the user into saving the document and convincing the user to send the document back to the attacker. The vulnerability is mitigated by the need for the attacker to know the precise file path in the target system, and the need to trick the user into saving the document and sending it back.
It was found that LibreOffice disclosed contents of a file specified in an embedded object's preview. An attacker could potentially use this flaw to expose details
Debian
CVE-2017-3157: libreoffice - By exploiting the way Apache OpenOffice before 4.1.4 renders embedded objects, a...
vendor_debian·2017·CVSS 5.5
CVE-2017-3157 [MEDIUM] CVE-2017-3157: libreoffice - By exploiting the way Apache OpenOffice before 4.1.4 renders embedded objects, a...
By exploiting the way Apache OpenOffice before 4.1.4 renders embedded objects, an attacker could craft a document that allows reading in a file from the user's filesystem. Information could be retrieved by the attacker by, e.g., using hidden sections to store the information, tricking the user into saving the document and convincing the user to send the document back to the attacker. The vulnerability is mitigated by the need for the attacker to know the precise file path in the target system, and the need to trick the user into saving the document and sending it back.
Scope: local
bookworm: resolved (fixed in 1:5.2.3-1)
bullseye: resolved (fixed in 1:5.2.3-1)
forky: resolved (fixed in 1:5.2.3-1)
sid: resolved (fixed in 1:5.2.3-1)
trixie: resolved (fixed in 1:5.2.3-1)
No detection rules found.
No public exploits indexed.
http://www.securityfocus.com/bid/96402http://www.securitytracker.com/id/1037893https://access.redhat.com/errata/RHSA-2017:0914https://access.redhat.com/errata/RHSA-2017:0979https://www.debian.org/security/2017/dsa-3792https://www.openoffice.org/security/cves/CVE-2017-3157.htmlhttp://www.securityfocus.com/bid/96402http://www.securitytracker.com/id/1037893https://access.redhat.com/errata/RHSA-2017:0914https://access.redhat.com/errata/RHSA-2017:0979https://www.debian.org/security/2017/dsa-3792https://www.openoffice.org/security/cves/CVE-2017-3157.html
2017-11-20
Published