Debian update for libreoffice
| Risk | High |
| Patch available | YES |
| Number of vulnerabilities | 2 |
| CVE-ID | CVE-2017-12607 CVE-2017-12608 |
| CWE-ID | CWE-787 |
| Exploitation vector | Network |
| Public exploit |
Public exploit code for vulnerability #1 is available. Public exploit code for vulnerability #2 is available. |
| Vulnerable software |
Debian Linux Operating systems & Components / Operating system |
| Vendor | Debian |
Security Bulletin
This security bulletin contains information about 2 vulnerabilities.
1) Out-of-bounds write
EUVDB-ID: #VU8962
Risk: High
CVSSv4.0: 7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber]
CVE-ID: CVE-2017-12607
CWE-ID:
CWE-787 - Out-of-bounds write
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker can execute arbitrary code on the target system.
The weakness exists due to boundary error in the PPTStyleSheet::PPTStyleSheet functionality. A remote attacker can send a specially crafted .ppt file, trick the victim into opening it, trigger out-of-bounds write and execute arbitrary code with privileges of the current user.
Successful exploitation of the vulnerability may result in system compromise.
Update the affected package to version: 1:4.3.3-2+deb8u9
Vulnerable software versionsDebian Linux: All versions
CPE2.3 External linkshttps://www.openoffice.org/security/cves/CVE-2017-12607.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
2) Out-of-bounds write
EUVDB-ID: #VU8963
Risk: High
CVSSv4.0: 7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber]
CVE-ID: CVE-2017-12608
CWE-ID:
CWE-787 - Out-of-bounds write
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker can execute arbitrary code on the target system.
The weakness exists due to boundary error in the WW8RStyle::ImportOldFormatStyles functionality. A remote attacker can send a specially crafted .doc file, trick the victim into opening it, trigger out-of-bounds write and execute arbitrary code with privileges of the current user.
Successful exploitation of the vulnerability may result in system compromise.
Update the affected package to version: 1:4.3.3-2+deb8u9
Vulnerable software versionsDebian Linux: All versions
CPE2.3 External linkshttps://www.openoffice.org/security/cves/CVE-2017-12608.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
