CVE-2018-10120

The SwCTBWrapper::Read function in sw/source/filter/ww8/ww8toolbar.cxx in LibreOffice before 5.4.6.1 and 6.x before 6.0.2.1 does not validate a customizations index, which allows remote attackers to cause a denial of service (heap-based buffer overflow with write access) or possibly have unspecified other impact via a crafted document that contains a certain Microsoft Word record.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.8 HIGH
LOCAL
LOW
NONE
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 39%
VendorProductVersion
debiandebian_linux
7.0
debiandebian_linux
8.0
debiandebian_linux
9.0
libreofficelibreoffice
𝑥
< 5.4.6.1
libreofficelibreoffice
6.0.0 ≤
𝑥
< 6.0.2.1
redhatenterprise_linux_desktop
7.0
redhatenterprise_linux_server
7.0
redhatenterprise_linux_workstation
7.0
canonicalubuntu_linux
14.04
canonicalubuntu_linux
16.04
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
libreoffice
bullseye
1:7.0.4-4+deb11u10
fixed
bullseye (security)
1:7.0.4-4+deb11u11
fixed
bookworm
4:7.4.7-1+deb12u4
fixed
bookworm (security)
4:7.4.7-1+deb12u5
fixed
sid
4:24.8.2-2
fixed
trixie
4:24.8.2-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
libreoffice
cosmic
not-affected
bionic
not-affected
artful
not-affected
xenial
Fixed 1:5.1.6~rc2-0ubuntu1~xenial6
released
trusty
Fixed 1:4.2.8-0ubuntu5.5
released