Ubuntu update for LibreOffice

Published: 2017-02-23

Risk	Low
Patch available	YES
Number of vulnerabilities	1
CVE-ID	CVE-2017-3157
CWE-ID	CWE-200
Exploitation vector	Network
Public exploit	N/A
Vulnerable software	Ubuntu Operating systems & Components / Operating system
Vendor	Canonical Ltd.

Security Bulletin

This security bulletin contains one low risk vulnerability.

1) Arbitrary file disclosure

EUVDB-ID: #VU5891

Risk: Low

CVSSv4.0: 0.2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-3157

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote attacker to obtain potentially sensitive information.

The vulnerability exists within calc and write functionality of LibreOffice when processing embedded objects during preview of files. A remote attacker can create a specially crafted document, linked to an existing file on victims system, trick the victim into opening the document, saving it and sending back to the attacker.

Successful exploitation of the vulnerability may allow an attacker to view contents of arbitrary files on the system.

Mitigation

Update the affected packages

Ubuntu 16.04 LTS:

libreoffice-base 1:5.1.6~rc2-0ubuntu1~xenial1

libreoffice-calc 1:5.1.6~rc2-0ubuntu1~xenial1

libreoffice-common 1:5.1.6~rc2-0ubuntu1~xenial1

libreoffice-math 1:5.1.6~rc2-0ubuntu1~xenial1

libreoffice-writer 1:5.1.6~rc2-0ubuntu1~xenial1

libreoffice 1:5.1.6~rc2-0ubuntu1~xenial1

libreoffice-base-core 1:5.1.6~rc2-0ubuntu1~xenial1

libreoffice-core 1:5.1.6~rc2-0ubuntu1~xenial1