CVE-2018-10119 PUBLISHED

sot/source/sdstor/stgstrms.cxx in LibreOffice before 5.4.5.1 and 6.x before 6.0.1.1 uses an incorrect integer data type in the StgSmallStrm class, which allows remote attackers to cause a denial of service (use-after-free with write access) or possibly have unspecified other impact via a crafted document that uses the structured storage ole2 wrapper file format.

EPSS 0.55% · 67.6th percentile

Risk Scores

EPSS Score
0.55%
67.6th percentile

Affected Products

VendorProductVersions
Ubuntu:16.04:LTSlibreoffice0, 1:5.0.2-0ubuntu1, 1:5.0.2-0ubuntu2
Ubuntu:14.04:LTSlibreoffice1:4.2.8-0ubuntu5, 1:4.2.8-0ubuntu5.1, 0

Timeline

References

Open in Interactive Console →