CVE-2018-14939 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Libreoffice

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer5 documents5 sources
Severity
9.8CRITICALNVD
EPSS
0.5%
top 33.75%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
LibreofficeDebian Libreoffice
Timeline
PublishedAug 5
Latest updateMay 14

Description

The get_app_path function in desktop/unx/source/start.c in LibreOffice through 6.0.5 mishandles the realpath function in certain environments such as FreeBSD libc, which might allow attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact if LibreOffice is automatically launched during web browsing with pathnames controlled by a remote web site.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

🔴Vulnerability Details

1
GHSA
GHSA-83w8-rxv4-7jg8: The get_app_path function in desktop/unx/source/start↗2022-05-14
▶

📋Vendor Advisories

2
Red Hat
libreoffice: Use of realpath() in desktop/unx/source/start.c:get_app_path() allows for potential buffer overflow↗2018-07-03
▶
Debian
CVE-2018-14939: libreoffice - The get_app_path function in desktop/unx/source/start.c in LibreOffice through 6...↗2018
▶

💬Community

1
Bugzilla
CVE-2018-14939 libreoffice: Use of realpath() in desktop/unx/source/start.c:get_app_path() allows for potential buffer overflow↗2018-08-09
▶