By exploiting the way Apache OpenOffice before 4.1.4 renders embedded objects, an attacker could craft a document that allows reading in a file from the user's filesystem. Information could be retrieved by the attacker by, e.g., using hidden sections to store the information, tricking the user into saving the document and convincing the user to send the document back to the attacker. The vulnerability is mitigated by the need for the attacker to know the precise file path in the target system, and the need to trick the user into saving the document and sending it back.

The version of Apache OpenOffice installed on the remote host is a version prior to 4.1.4. It is, therefore, affected by multiple Out-of-Bounds vulnerabilities and a file disclosure vulnerability in Calc/Writer.

The Apache Openofffice project reports : CVE-2017-3157: Arbitrary file disclosure in Calc and Writer By exploiting the way OpenOffice renders embedded objects, an attacker could craft a document that allows reading in a file from the user's filesystem. Information could be retrieved by the attacker by, e.g., using hidden sections to store the information, tricking the user into saving the document and convincing the user to sent the document back to the attacker.

The vulnerability is mitigated by the need for the attacker to know the precise file path in the target system, and the need to trick the user into saving the document and sending it back. CVE-2017-9806:
Out-of-Bounds Write in Writer's WW8Fonts Constructor A vulnerability in the OpenOffice Writer DOC file parser, and specifically in the WW8Fonts Constructor, allows attackers to craft malicious documents that cause denial of service (memory corruption and application crash) potentially resulting in arbitrary code execution. CVE-2017-12607:
Out-of-Bounds Write in Impress' PPT Filter A vulnerability in OpenOffice's PPT file parser, and specifically in PPTStyleSheet, allows attackers to craft malicious documents that cause denial of service (memory corruption and application crash) potentially resulting in arbitrary code execution. CVE-2017-12608: Out-of-Bounds Write in Writer's ImportOldFormatStyles A vulnerability in OpenOffice Writer DOC file parser, and specifically in ImportOldFormatStyles, allows attackers to craft malicious documents that cause denial of service (memory corruption and application crash) potentially resulting in arbitrary code execution.

An update for libreoffice is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a drawing program. LibreOffice replaces OpenOffice and provides a similar but enhanced and extended office suite.

Security Fix(es) :

* It was found that LibreOffice disclosed contents of a file specified in an embedded object's preview. An attacker could potentially use this flaw to expose details of a system running LibreOffice as an online service via a crafted document. (CVE-2017-3157)

Note that Tenable Network Security has attempted to extract the preceding description block directly from the corresponding Red Hat security advisory. Virtuozzo provides no description for VZLSA advisories. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for libreoffice is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a drawing program. LibreOffice replaces OpenOffice and provides a similar but enhanced and extended office suite.

Security Fix(es) :

* It was found that LibreOffice disclosed contents of a file specified in an embedded object's preview. An attacker could potentially use this flaw to expose details of a system running LibreOffice as an online service via a crafted document. (CVE-2017-3157)

Bug Fix(es) :

* Previously, an improper resource management caused the LibreOffice Calc spreadsheet application to terminate unexpectedly after closing a dialog window with accessibility support enabled. The resource management has been improved, and the described problem no longer occurs. (BZ#1425536)

* Previously, when an incorrect password was entered for a password protected document, the document has been considered as valid and a fallback attempt to open it as plain text has been made. As a consequence, it could appear that the document succesfully loaded, while just the encrypted unreadable content was shown. A fix has been made to terminate import attempts after entering incorrect password, and now nothing is loaded when a wrong password is entered.
(BZ#1426348)

* Previously, an improper resource management caused the LibreOffice Calc spreadsheet application to terminate unexpectedly during exit, after the Text Import dialog for CSV (Comma-separated Value) files closed, when accessibility support was enabled. The resource management has been improved, and the described problem no longer occurs. (BZ#1425535)

Note that Tenable Network Security has attempted to extract the preceding description block directly from the corresponding Red Hat security advisory. Virtuozzo provides no description for VZLSA advisories. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

CVE-2017-3157

Ben Hayak discovered that objects embedded in Writer and Calc documents may result in information disclosure. Please see https://www.libreoffice.org/about-us/security/advisories/cve-2017-3157 / for additional information.

CVE-2017-7870

An out-of-bounds write caused by a heap-based buffer overflow was found in the Polygon class.

For Debian 7 'Wheezy', these problems have been fixed in version 1:3.5.4+dfsg2-0+deb7u9.

We recommend that you upgrade your libreoffice packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security Fix(es) :

  - It was found that LibreOffice disclosed contents of a     file specified in an embedded object's preview. An     attacker could potentially use this flaw to expose     details of a system running LibreOffice as an online     service via a crafted document. (CVE-2017-3157)

An update for libreoffice is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a drawing program. LibreOffice replaces OpenOffice and provides a similar but enhanced and extended office suite.

Security Fix(es) :

* It was found that LibreOffice disclosed contents of a file specified in an embedded object's preview. An attacker could potentially use this flaw to expose details of a system running LibreOffice as an online service via a crafted document. (CVE-2017-3157)

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2017-0979 advisory.

    [1:4.3.7.2-2.0.1.1]
    - Replaced RedHat colors with Oracle colors, and the filename redhat.soc with oracle.soc in specfile     (jingdong.lu@oracle.com)
    - Build with --with-vendor='Oracle America, Inc.' (jingdong.lu@oracle.com)

    [1:4.3.7.2-2.1]
    - Resolves: rhbz#1435532 CVE-2017-3157 Arbitrary file disclosure in Calc and       Writer

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update for libreoffice is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a drawing program. LibreOffice replaces OpenOffice and provides a similar but enhanced and extended office suite.

Security Fix(es) :

* It was found that LibreOffice disclosed contents of a file specified in an embedded object's preview. An attacker could potentially use this flaw to expose details of a system running LibreOffice as an online service via a crafted document. (CVE-2017-3157)

Bug Fix(es) :

* Previously, an improper resource management caused the LibreOffice Calc spreadsheet application to terminate unexpectedly after closing a dialog window with accessibility support enabled. The resource management has been improved, and the described problem no longer occurs. (BZ#1425536)

* Previously, when an incorrect password was entered for a password protected document, the document has been considered as valid and a fallback attempt to open it as plain text has been made. As a consequence, it could appear that the document succesfully loaded, while just the encrypted unreadable content was shown. A fix has been made to terminate import attempts after entering incorrect password, and now nothing is loaded when a wrong password is entered.
(BZ#1426348)

* Previously, an improper resource management caused the LibreOffice Calc spreadsheet application to terminate unexpectedly during exit, after the Text Import dialog for CSV (Comma-separated Value) files closed, when accessibility support was enabled. The resource management has been improved, and the described problem no longer occurs. (BZ#1425535)

Security Fix(es) :

  - It was found that LibreOffice disclosed contents of a     file specified in an embedded object's preview. An     attacker could potentially use this flaw to expose     details of a system running LibreOffice as an online     service via a crafted document. (CVE-2017-3157)

Bug Fix(es) :

  - Previously, an improper resource management caused the     LibreOffice Calc spreadsheet application to terminate     unexpectedly after closing a dialog window with     accessibility support enabled. The resource management     has been improved, and the described problem no longer     occurs.

  - Previously, when an incorrect password was entered for a     password protected document, the document has been     considered as valid and a fallback attempt to open it as     plain text has been made. As a consequence, it could     appear that the document succesfully loaded, while just     the encrypted unreadable content was shown. A fix has     been made to terminate import attempts after entering     incorrect password, and now nothing is loaded when a     wrong password is entered.

  - Previously, an improper resource management caused the     LibreOffice Calc spreadsheet application to terminate     unexpectedly during exit, after the Text Import dialog     for CSV (Comma-separated Value) files closed, when     accessibility support was enabled. The resource     management has been improved, and the described problem     no longer occurs.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2017-0914 advisory.

    - Resolves: rhbz#1435534 CVE-2017-3157 Arbitrary file disclosure in Calc and       Writer
    - Resolves: rhbz#1353839 CVE-2016-4324 dereference of invalid STL iterator on       processing RTF file

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of LibreOffice installed on the remote Mac OS X or macOS host is prior to 5.1, 5.1.x prior to 5.1.6, or 5.2.x prior to 5.2.5.
It is, therefore, affected by multiple vulnerabilities :

  - An overflow condition exists when processing EMF files,     specifically in the EnhWMFReader::ReadEnhWMF() function     within file vcl/source/filter/wmf/enhwmf.cxx, due to     improper validation of a certain offset value in the     header that precedes bitmap data. An unauthenticated,     remote attacker can exploit this, via a specially     crafted enhanced metafile file (EMF), to cause a denial     of service condition or the execution of arbitrary code.
    Note that this vulnerability does not affect version     5.1.x. (CVE-2016-10327)

  - A file disclosure vulnerability exists due to a flaw in     the content preview feature when handling embedded     objects. An unauthenticated, remote attacker can exploit     this, via a specially crafted file, to disclose details     of a file on the hosting system. (CVE-2017-3157)

  - An overflow condition exists in the Polygon::Insert()     function within file tools/source/generic/poly.cxx     when processing polygons in Windows metafiles (WMF) that     under certain circumstances result in polygons with more     points than can represented in LibreOffice's internal     polygon class. An unauthenticated, remote attacker can     exploit this, via a specially crafted WMF file, to cause     a denial of service condition or the execution of     arbitrary code. Note that this vulnerability does not     affect version 5.1.x. (CVE-2017-7870)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of LibreOffice installed on the remote Windows host is prior to 5.1, 5.1.x prior to 5.1.6, or 5.2.x prior to 5.2.5. It is, therefore, affected by multiple vulnerabilities :

  - An overflow condition exists when processing EMF files,     specifically in the EnhWMFReader::ReadEnhWMF() function     within file vcl/source/filter/wmf/enhwmf.cxx, due to     improper validation of a certain offset value in the     header that precedes bitmap data. An unauthenticated,     remote attacker can exploit this, via a specially     crafted enhanced metafile file (EMF), to cause a denial     of service condition or the execution of arbitrary code.
    Note that this vulnerability does not affect version     5.1.x. (CVE-2016-10327)

  - A file disclosure vulnerability exists due to a flaw in     the content preview feature when handling embedded     objects. An unauthenticated, remote attacker can exploit     this, via a specially crafted file, to disclose details     of a file on the hosting system. (CVE-2017-3157)

  - An overflow condition exists in the Polygon::Insert()     function within file tools/source/generic/poly.cxx     when processing polygons in Windows metafiles (WMF) that     under certain circumstances result in polygons with more     points than can represented in LibreOffice's internal     polygon class. An unauthenticated, remote attacker can     exploit this, via a specially crafted WMF file, to cause     a denial of service condition or the execution of     arbitrary code. Note that this vulnerability does not     affect version 5.1.x. (CVE-2017-7870)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3210-1 advisory.

    Ben Hayak discovered that it was possible to make LibreOffice Calc and Writer disclose arbitrary files to     an attacker if a user opened a specially crafted file with embedded links.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Ben Hayak discovered that objects embedded in Writer and Calc documents may result in information disclosure. Please see https://www.libreoffice.org/about-us/security/advisories/cve-2017-3157 /for additional information.

ID	Name	Product	Family	Severity
104351	Apache OpenOffice < 4.1.4 Multiple Vulnerabilities	Nessus	Windows	high
104162	FreeBSD : Apache OpenOffice -- multiple vulnerabilities (27229c67-b8ff-11e7-9f79-ac9e174be3af)	Nessus	FreeBSD Local Security Checks	high
101451	Virtuozzo 6 : autocorr-af / autocorr-bg / autocorr-ca / etc (VZLSA-2017-0979)	Nessus	Virtuozzo Local Security Checks	medium
101447	Virtuozzo 7 : autocorr-af / autocorr-bg / autocorr-ca / etc (VZLSA-2017-0914)	Nessus	Virtuozzo Local Security Checks	medium
99604	Debian DLA-910-1 : libreoffice security update	Nessus	Debian Local Security Checks	critical
99505	Scientific Linux Security Update : libreoffice on SL6.x i386/x86_64 (20170418)	Nessus	Scientific Linux Local Security Checks	medium
99481	CentOS 6 : libreoffice (CESA-2017:0979)	Nessus	CentOS Local Security Checks	medium
99451	Oracle Linux 6 : libreoffice (ELSA-2017-0979)	Nessus	Oracle Linux Local Security Checks	medium
99431	RHEL 6 : libreoffice (RHSA-2017:0979)	Nessus	Red Hat Local Security Checks	medium
99381	CentOS 7 : libreoffice (CESA-2017:0914)	Nessus	CentOS Local Security Checks	medium
99352	Scientific Linux Security Update : libreoffice on SL7.x x86_64 (20170412)	Nessus	Scientific Linux Local Security Checks	medium
99342	RHEL 7 : libreoffice (RHSA-2017:0914)	Nessus	Red Hat Local Security Checks	medium
99331	Oracle Linux 7 : libreoffice (ELSA-2017-0914)	Nessus	Oracle Linux Local Security Checks	medium
97497	LibreOffice < 5.1.6 / 5.2.5 / 5.3.0 Multiple Vulnerabilities (macOS)	Nessus	MacOS X Local Security Checks	critical
97496	LibreOffice < 5.1.6 / 5.2.5 / 5.3.0 Multiple Vulnerabilities	Nessus	Windows	critical
97383	Ubuntu 14.04 LTS / 16.04 LTS : LibreOffice vulnerability (USN-3210-1)	Nessus	Ubuntu Local Security Checks	medium
97358	Debian DSA-3792-1 : libreoffice - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2017-3157

medium

Tenable Plugins

high

high

medium

medium

critical

medium

medium

medium

medium

medium

medium

medium

medium

critical

critical

medium

medium