CVE-2018-10120 — Improper Validation of Array Index in Libreoffice

CWE-129 — Improper Validation of Array IndexCWE-787 — Out-of-bounds Write9 documents7 sources
Severity
7.8HIGHNVD
EPSS
0.5%
top 34.06%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
7
LibreofficeDebian LibreofficeCanonical Ubuntu Linux+4 more
Timeline
PublishedApr 16
Latest updateMay 13

Description

The SwCTBWrapper::Read function in sw/source/filter/ww8/ww8toolbar.cxx in LibreOffice before 5.4.6.1 and 6.x before 6.0.2.1 does not validate a customizations index, which allows remote attackers to cause a denial of service (heap-based buffer overflow with write access) or possibly have unspecified other impact via a crafted document that contains a certain Microsoft Word record.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages7 packages

▶debiandebian/libreoffice< libreoffice 1:6.0.2-1 (bookworm)
▶NVDlibreoffice/libreoffice6.0.0 — 6.0.2.1+1
▶Debianlibreoffice/libreoffice< 1:6.0.2-1+3
▶Ubuntulibreoffice/libreoffice< 1:4.2.8-0ubuntu5.5+1

Also affects: Debian Linux 7.0, 8.0, 9.0, Ubuntu Linux 14.04, 16.04

Patches

Patch: gerrit.libreoffice.org ↗Patch: gerrit.libreoffice.org ↗Patch: gerrit.libreoffice.org ↗

🔴Vulnerability Details

3
GHSA
GHSA-m6cw-v9mq-9wmh: The SwCTBWrapper::Read function in sw/source/filter/ww8/ww8toolbar↗2022-05-13
▶
OSV
libreoffice vulnerabilities↗2019-02-06
▶
OSV
CVE-2018-10120: The SwCTBWrapper::Read function in sw/source/filter/ww8/ww8toolbar↗2018-04-16
▶

📋Vendor Advisories

3
Ubuntu
LibreOffice vulnerabilities↗2019-02-06
▶
Red Hat
libreoffice: Out of bounds write in filter/ww8/ww8toolbar.cxx:SwCTBWrapper class allows for denial of service with crafted document↗2018-02-09
▶
Debian
CVE-2018-10120: libreoffice - The SwCTBWrapper::Read function in sw/source/filter/ww8/ww8toolbar.cxx in LibreO...↗2018
▶

💬Community

2
Bugzilla
CVE-2018-10120 libreoffice: Out of bounds write in filter/ww8/ww8toolbar.cxx:SwCTBWrapper class allows for denial of service with crafted document [fedora-all]↗2018-04-20
▶
Bugzilla
CVE-2018-10120 libreoffice: Out of bounds write in filter/ww8/ww8toolbar.cxx:SwCTBWrapper class allows for denial of service with crafted document↗2018-04-20
▶