CVE-2017-3157

Publication date 22 February 2017

Last updated 24 July 2024

Ubuntu priority

Cvss 3 Severity Score

By exploiting the way Apache OpenOffice before 4.1.4 renders embedded objects, an attacker could craft a document that allows reading in a file from the user's filesystem. Information could be retrieved by the attacker by, e.g., using hidden sections to store the information, tricking the user into saving the document and convincing the user to send the document back to the attacker. The vulnerability is mitigated by the need for the attacker to know the precise file path in the target system, and the need to trick the user into saving the document and sending it back.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
libreoffice	16.10 yakkety	Not affected
	16.04 LTS xenial	Fixed 1:5.1.6~rc2-0ubuntu1~xenial1
	14.04 LTS trusty	Fixed 1:4.2.8-0ubuntu5
	12.04 LTS precise	Fixed 1:3.5.7-0ubuntu13
openoffice.org	16.10 yakkety	Not in release
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Not in release
	12.04 LTS precise	Not affected

Severity score breakdown

Parameter	Value
Base score	5.5 · Medium
Attack vector	Local
Attack complexity	Low
Privileges required	None
User interaction	Required
Scope	Unchanged
Confidentiality	High
Integrity impact	None
Availability impact	None
Vector	CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

References

Related Ubuntu Security Notices (USN)