CVE-2018-10583 An information disclosure vulnerability occurs when LibreOffice 6.0.3 and Apache OpenOffice Writer 4.1.5 automatically process and initiate an SMB connection embedded in a malicious file, as demonstra...
HighCVSS 7.5
EPSS 79.5%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
An information disclosure vulnerability occurs when LibreOffice 6.0.3 and Apache OpenOffice Writer 4.1.5 automatically process and initiate an SMB connection embedded in a malicious file, as demonstrated by xlink:href=file://192.168.0.2/test.jpg within an office:document-content element in a .odt XML document.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libreoffice(Debian:12) | All versions | No fix listed |
| debian/libreoffice(Debian:12) | = 4:24.2.0-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:24.2.0-1~bpo12+1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:24.2.0-2 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:24.2.0-3 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:24.2.0~alpha1-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:24.2.0~beta1-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:24.2.0~rc1-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:24.2.0~rc1-2 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:24.2.0~rc2-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:24.2.0~rc2-2 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:24.2.0~rc2-2~bpo12+1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:24.2.1-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:24.2.1-2 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:24.2.1-3 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:24.2.1-4 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:24.2.1~rc1-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:24.2.1~rc2-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:24.2.2-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:24.2.2-2 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:24.2.2-3 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:24.2.2~rc1-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:24.2.2~rc1-2 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:24.2.2~rc2-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:24.2.2~rc2-2 | No fix listed |
Show 175 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libreoffice(Debian:12) | = 4:24.2.3-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:24.2.3-1~bpo12+1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:24.2.3-2 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:24.2.3~rc1-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:24.2.3~rc1-2 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:24.2.3~rc1-3 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:24.2.3~rc2-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:24.2.4-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:24.2.4-1~bpo12+1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:24.2.5-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:24.2.5-1~bpo12+1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:24.2.5-2 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:24.2.5-3 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:24.2.5-4 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:24.2.6-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:24.2.6-2 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:24.2.6-2~bpo12+1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:24.8.0~alpha1-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:24.8.0~alpha1-2 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:24.8.0~alpha1-3 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:24.8.0~alpha1-4 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:24.8.0~beta1-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:24.8.0~rc1-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:24.8.0~rc2-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:24.8.0~rc3-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:24.8.0~rc3-2 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:24.8.1-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:24.8.1-2 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:24.8.1~rc1-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:24.8.2-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:24.8.2-1~bpo12+1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:24.8.2-2 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:24.8.2~rc1-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:24.8.3-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:24.8.3-1~bpo12+1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:24.8.3-2 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:24.8.3-3 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:24.8.4-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:24.8.4-1~bpo12+1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:24.8.4-2 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:24.8.4-3 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:24.8.4-4 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:24.8.5-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:24.8.5-2 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:24.8.5-2~bpo12+1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:24.8.5-2~bpo12+2 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:25.2.0~alpha1-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:25.2.0~beta1-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:25.2.0~beta1-2 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:25.2.0~rc1-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:25.2.0~rc1-2 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:25.2.0~rc1-3 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:25.2.0~rc1-4 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:25.2.0~rc2-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:25.2.0~rc3-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:25.2.0~rc3-2 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:25.2.1-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:25.2.1-2 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:25.2.1-3 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:25.2.1-3~bpo12+1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:25.2.1~rc1-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:25.2.1~rc1-2 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:25.2.1~rc2-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:25.2.2-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:25.2.2-1~bpo12+1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:25.2.2-2 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:25.2.2-3 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:25.2.2-3~bpo12+1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:25.2.2~rc1-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:25.2.2~rc2-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:25.2.3-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:25.2.3-2 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:25.2.3-2~bpo12+1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:25.2.3~rc1-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:25.2.3~rc1-2 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:25.2.3~rc2-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:25.8.0-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:25.8.0-1~bpo13+1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:25.8.0~alpha1-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:25.8.0~alpha1-2 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:25.8.0~beta1-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:25.8.0~rc1-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:25.8.0~rc1-2 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:25.8.0~rc2-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:25.8.0~rc2-2 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:25.8.0~rc3-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:25.8.0~rc4-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:25.8.0~rc4-2 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:25.8.1-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:25.8.1-1~bpo13+1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:25.8.1~rc1-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:25.8.2-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:25.8.2-2 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:25.8.2-3 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:25.8.2-3~bpo13+1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:25.8.2~rc1-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:25.8.2~rc2-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:25.8.3-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:25.8.3-1+ports | No fix listed |
| debian/libreoffice(Debian:12) | = 4:25.8.3-1~bpo13+1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:25.8.3~rc1-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:25.8.3~rc2-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:25.8.4-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:25.8.4-1~bpo13+1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:26.2.0-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:26.2.0-1~bpo13+1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:26.2.0~alpha1-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:26.2.0~alpha1-2 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:26.2.0~alpha1-3 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:26.2.0~beta1-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:26.2.0~rc1-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:26.2.0~rc2-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:26.2.0~rc3-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:26.2.1-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:26.2.1-1~bpo13+1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:26.2.1~rc1-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:26.2.1~rc2-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:26.2.2.1-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:26.2.2.1-2 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:26.2.2.2-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:26.2.2.2-2 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:26.2.2.2-3 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:26.2.2.2-3~bpo13+1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:26.2.3.1-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:26.2.3.2-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:26.2.3.2-2 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:26.2.3.2-2~bpo13+1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:26.2.4.1-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:26.2.4.2-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:26.2.4.2-1~bpo13+1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:26.2.4.2-2 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:26.2.5.2-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:26.2.5.2-2 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:26.2.5.2-2~bpo13+1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:26.8.0.0.alpha1-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:26.8.0.0.alpha1-2 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:26.8.0.0.alpha1-3 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:26.8.0.0.alpha1-4 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:26.8.0.0.beta1-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:26.8.0.1-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:26.8.0.2-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:26.8.0.3-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:26.8.0.3-2 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:26.8.0.3-2~bpo13+1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:26.8.1.1-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:26.8.1.1-2 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:26.8.1.1-3 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:26.8.1.1-3~bpo13+1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:26.8.1.1-3~bpo13+2 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:26.8.2.1-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:26.8.2.1-2 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:7.4.5-3 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:7.4.7-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:7.4.7-1+deb12u1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:7.4.7-1+deb12u10 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:7.4.7-1+deb12u11 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:7.4.7-1+deb12u12 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:7.4.7-1+deb12u13 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:7.4.7-1+deb12u14 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:7.4.7-1+deb12u1~bpo11+1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:7.4.7-1+deb12u2 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:7.4.7-1+deb12u2~bpo11+1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:7.4.7-1+deb12u3 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:7.4.7-1+deb12u4 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:7.4.7-1+deb12u5 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:7.4.7-1+deb12u6 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:7.4.7-1+deb12u7 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:7.4.7-1+deb12u8 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:7.4.7-1+deb12u9 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:7.4.7-1~bpo11+1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:7.5.0~rc2-7 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:7.5.0~rc3-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:7.5.1~rc1-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:7.5.1~rc2-1 | No fix listed |
| debian/libreoffice(Debian:12) | = 4:7.5.2~rc1-1 | No fix listed |
References
- Debian Security Tracker CVE-2018-10583 issue-tracking third-party-advisory vendor-advisory
- 20201021 [RT-SA-2020-005] Arbitrary File Disclosure and Server-Side Request Forgery in BigBlueButton mailing-list
- secureyourit.co.uk exploit mitigation third-party-advisory
- RHSA-2018:3054 third-party-advisory vendor-advisory
- [openoffice-dev] 20190929 Re: CVE-2018-10583 mailing-list
- [openoffice-dev] 20190928 CVE-2018-10583 mailing-list
- [openoffice-dev] 20190930 Re: CVE-2018-10583 mailing-list
- USN-3883-1 third-party-advisory vendor-advisory
- 44564 exploit third-party-advisory vdb-entry