Executive Summary

Summary
Title LibreOffice vulnerabilities
Informations
NameUSN-3883-1First vendor Publication2019-02-06
VendorUbuntuLast vendor Modification2019-02-06
Severity (Vendor) N/ARevisionN/A

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Cvss Base Score6.8Attack RangeNetwork
Cvss Impact Score6.4Attack ComplexityMedium
Cvss Expoit Score8.6AuthenticationNone Required
Calculate full CVSS 2.0 Vectors scores

Detail

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 16.04 LTS - Ubuntu 14.04 LTS

Summary:

Several security issues were fixed in LibreOffice.

Software Description: - libreoffice: Office productivity suite

Details:

It was discovered that LibreOffice incorrectly handled certain document files. If a user were tricked into opening a specially crafted document, a remote attacker could cause LibreOffice to crash, and possibly execute arbitrary code. (CVE-2018-10119, CVE-2018-10120, CVE-2018-11790)

It was discovered that LibreOffice incorrectly handled embedded SMB connections in document files. If a user were tricked in to opening a specially crafted document, a remote attacker could possibly exploit this to obtain sensitive information. (CVE-2018-10583)

Alex Inführ discovered that LibreOffice incorrectly handled embedded scripts in document files. If a user were tricked into opening a specially crafted document, a remote attacker could possibly execute arbitrary code. (CVE-2018-16858)

Update instructions:

The problem can be corrected by updating your system to the following package versions:

Ubuntu 16.04 LTS:
libreoffice-core 1:5.1.6~rc2-0ubuntu1~xenial6

Ubuntu 14.04 LTS:
libreoffice-core 1:4.2.8-0ubuntu5.5

After a standard system update you need to restart LibreOffice to make all the necessary changes.

References:
https://usn.ubuntu.com/usn/usn-3883-1
CVE-2018-10119, CVE-2018-10120, CVE-2018-10583, CVE-2018-11790,
CVE-2018-16858

Package Information:
https://launchpad.net/ubuntu/+source/libreoffice/1:5.1.6~rc2-0ubuntu1~xenial6
https://launchpad.net/ubuntu/+source/libreoffice/1:4.2.8-0ubuntu5.5

Original Source

Url : http://www.ubuntu.com/usn/USN-3883-1

CWE : Common Weakness Enumeration

%idName
25 %CWE-682Incorrect Calculation
25 %CWE-416Use After Free
25 %CWE-200Information Exposure
25 %CWE-119Failure to Constrain Operations within the Bounds of a Memory Buffer

CPE : Common Platform Enumeration

TypeDescriptionCount
Application1
Application1
Application20
Os2
Os3
Os1
Os1
Os1

Nessus® Vulnerability Scanner

DateDescription
2019-01-03Name : The remote Fedora host is missing a security update.
File : fedora_2018-8d3f4d7b28.nasl - Type : ACT_GATHER_INFO
2018-05-14Name : The remote Fedora host is missing a security update.
File : fedora_2018-490f30ffa0.nasl - Type : ACT_GATHER_INFO
2018-04-30Name : The remote Fedora host is missing a security update.
File : fedora_2018-e87eb1ae68.nasl - Type : ACT_GATHER_INFO
2018-04-23Name : The remote Debian host is missing a security-related update.
File : debian_DSA-4178.nasl - Type : ACT_GATHER_INFO
2018-04-20Name : The remote Debian host is missing a security update.
File : debian_DLA-1356.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
DateInformations
2019-02-09 13:18:40
  • First insertion