An information disclosure vulnerability occurs when LibreOffice 6.0.3 and Apache OpenOffice Writer 4.1.5 automatically process and initiate an SMB connection embedded in a malicious file, as demonstrated by xlink:href=file://192.168.0.2/test.jpg within an office:document-content element in a .odt XML document.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - libreoffice: Multiple out-of-bounds overflows in lwp filter (CVE-2016-0795)

  - libreoffice: heap-based buffer overflow related to the ReadJPEG function (CVE-2017-8358)

  - LibreOffice 3.5.x before 3.5.7.2 and 3.6.x before 3.6.1, and OpenOffice.org (OOo), allows remote attackers     to cause a denial of service (NULL pointer dereference) via a crafted (1) odt file to vcllo.dll, (2) ODG     (Drawing document) file to svxcorelo.dll, (3) PolyPolygon record in a .wmf (Window Meta File) file     embedded in a ppt (PowerPoint) file to tllo.dll, or (4) xls (Excel) file to scfiltlo.dll. (CVE-2012-4233)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

According to the versions of the libreoffice packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The SwCTBWrapper::Read function in     sw/source/filter/ww8/ww8toolbar.cxx in LibreOffice     before 5.4.6.1 and 6.x before 6.0.2.1 does not validate     a customizations index, which allows remote attackers     to cause a denial of service (heap-based buffer     overflow with write access) or possibly have     unspecified other impact via a crafted document that     contains a certain Microsoft Word     record.(CVE-2018-10120)

  - An information disclosure vulnerability occurs when     LibreOffice 6.0.3 and Apache OpenOffice Writer 4.1.5     automatically process and initiate an SMB connection     embedded in a malicious file, as demonstrated by     xlink:href=file://192.168.0.2/test.jpg within an     office:document-content element in a .odt XML     document.(CVE-2018-10583)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for LibreOffice, libepubgen, liblangtag, libmwaw, libnumbertext, libstaroffice, libwps, myspell-dictionaries, xmlsec1 fixes the following issues :

LibreOffice was updated to 6.1.3.2 (fate#326624) and contains new features and lots of bugfixes :

The full changelog can be found on :

https://wiki.documentfoundation.org/ReleaseNotes/6.1

Bugfixes :

  - bsc#1095639 Exporting to PPTX results in vertical labels     being shown horizontally

  - bsc#1098891 Table in PPTX misplaced and partly blue

  - bsc#1088263 Labels in chart change (from white and other     colors) to black when saving as PPTX

  - bsc#1095601 Exporting to PPTX shifts arrow shapes quite     a bit

  - Add more translations :

  - Belarusian

  - Bodo

  - Dogri

  - Frisian

  - Gaelic

  - Paraguayan_Guaran

  - Upper_Sorbian

  - Konkani

  - Kashmiri

  - Luxembourgish

  - Monglolian

  - Manipuri

  - Burnese

  - Occitan

  - Kinyarwanda

  - Santali

  - Sanskrit

  - Sindhi

  - Sidamo

  - Tatar

  - Uzbek

  - Upper Sorbian

  - Venetian

  - Amharic

  - Asturian

  - Tibetian

  - Bosnian

  - English GB

  - English ZA

  - Indonesian

  - Icelandic

  - Georgian

  - Khmer

  - Lao

  - Macedonian

  - Nepali

  - Oromo

  - Albanian

  - Tajik

  - Uyghur

  - Vietnamese

  - Kurdish

  - Try to build all languages see bsc#1096360

  - Make sure to install the KDE5/Qt5 UI/filepicker

  - Try to implement safeguarding to avoid bsc#1050305

  - Disable base-drivers-mysql as it needs mysqlcppcon that     is only for mysql and not mariadb, causes issues     bsc#1094779

  - Users can still connect using jdbc/odbc

  - Fix java detection on machines with too many cpus

  - CVE-2018-10583: An information disclosure vulnerability     occured when LibreOffice automatically processed and     initiated an SMB connection embedded in a malicious     file, as demonstrated by     xlink:href=file://192.168.0.2/test.jpg within an     office:document-content element in a .odt XML document.
    (bsc#1091606)

libepubgen was updated to 0.1.1 :

  - Avoid <div> inside <p> or <span>.

  - Avoid writin vertical-align attribute without a value.

  - Fix generation of invalid XHTML when there is a link     starting at the beginning of a footnote.

  - Handle relative width for images.

  - Fixed layout: write chapter names to improve navigation.

  - Support writing mode.

  - Start a new HTML file at every page span in addition to     the splits induced by the chosen split method. This is     to ensure that specified writing mode works correctly,     as it is HTML <body> attribute.

liblangtag was updated to 0.6.2 :

  - use standard function

  - fix leak in test

libmwaw was updated to 0.3.14 :

  - Support MS Multiplan 1.1 files

libnumbertext was update to 1.0.5 :

  - Various fixes in numerical calculations and issues     reported on libreoffice tracker

libstaroffice was updated to 0.0.6 :

  - retrieve some StarMath's formula,

  - retrieve some charts as graphic,

  - retrieve some fields in sda/sdc/sdp text-boxes,

  - .sdw: retrieve more attachments.

libwps was updated to 0.4.9 :

  - QuattroPro: add parser to .wb3 files

  - Multiplan: add parser to DOS v1-v3 files

  - charts: try to retrieve charts in .wk*, .wq* files

  - QuattroPro: add parser to .wb[12] files

myspell-dictionaries was updated to 20181025 :

  - Turkish dictionary added

  - Updated French dictionary

xmlsec1 was updated to 1.2.26 :

  - Added xmlsec-mscng module based on Microsoft     Cryptography API: Next Generation

  - Added support for GOST 2012 and fixed CryptoPro CSP     provider for GOST R 34.10-2001 in xmlsec-mscrypto

This update was imported from the SUSE:SLE-15:Update update project.

This update for libreoffice to 6.0.5.2 fixes the following issues :

Security issues fixed :

  - CVE-2018-10583: An information disclosure vulnerability     occurs during automatic processing and initiating an SMB     connection embedded in a malicious file, as demonstrated     by xlink:href=file://192.168.0.2/test.jpg within an     office:document-content element in a .odt XML document.
    (bsc#1091606)

Non security issues fixed :

  - Bugfix: Table borders appear black in LibreOffice (while     white in PowerPoint) (bsc#1088262)

  - Bugfix: LibreOffice extension 'Language Tool' fails     after Tumbleweed update (bsc#1050305)

  - Bugfix: libreoffice-gnome can no longer be installed in     parallel to libreoffice-gtk3 as there is a potential     file conflict (bsc#1096673)

  - Bugfix: LibreOffice Writer: Text in boxes were not     visible (bsc#1094359)

  - Use libreoffice-gtk3 if xfce is present (bsc#1092699)

  - Various other bug fixes

This update was imported fromm the SUSE:SLE-15:Update update project.

The version of LibreOffice installed on the remote Windows host is either prior to 5.4.7 or 6.x prior to 6.0.4. It is, therefore, affected by an information disclosure vulnerability that exists in documents containing an embedded SMB link due to automatic initiation of image retrieval. An unauthenticated, remote attacker can exploit this, via an SMB connection embedded in a malicious file, to disclose potentially sensitive information.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3883-1 advisory.

    It was discovered that LibreOffice incorrectly handled certain document files. If a user were tricked into     opening a specially crafted document, a remote attacker could cause LibreOffice to crash, and possibly     execute arbitrary code. (CVE-2018-10119, CVE-2018-10120, CVE-2018-11790)

    It was discovered that LibreOffice incorrectly handled embedded SMB connections in document files. If a     user were tricked in to opening a specially crafted document, a remote attacker could possibly exploit     this to obtain sensitive information. (CVE-2018-10583)

    Alex Infhr discovered that LibreOffice incorrectly handled embedded scripts in document files. If a user     were tricked into opening a specially crafted document, a remote attacker could possibly execute arbitrary     code. (CVE-2018-16858)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

- CVE-2018-10583 A LibreOffice document with a linked     image, which is on a samba share, will cause LibreOffice     to automatically initiate a samba connection to retrieve     the image. This is by design. If end users or     administrators wish to disable this functionality this     can now be disabled via     tools->options->security->options->block any links from     documents not among the trusted locations.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for LibreOffice, libepubgen, liblangtag, libmwaw, libnumbertext, libstaroffice, libwps, myspell-dictionaries, xmlsec1 fixes the following issues :

LibreOffice was updated to 6.1.3.2 (fate#326624) and contains new features and lots of bugfixes :

The full changelog can be found on :

https://wiki.documentfoundation.org/ReleaseNotes/6.1

Bugfixes :

bsc#1095639 Exporting to PPTX results in vertical labels being shown horizontally

bsc#1098891 Table in PPTX misplaced and partly blue

bsc#1088263 Labels in chart change (from white and other colors) to black when saving as PPTX

bsc#1095601 Exporting to PPTX shifts arrow shapes quite a bit

Add more translations :

  - Belarusian

  - Bodo

  - Dogri

  - Frisian

  - Gaelic

  - Paraguayan_Guaran

  - Upper_Sorbian

  - Konkani

  - Kashmiri

  - Luxembourgish

  - Monglolian

  - Manipuri

  - Burnese

  - Occitan

  - Kinyarwanda

  - Santali

  - Sanskrit

  - Sindhi

  - Sidamo

  - Tatar

  - Uzbek

  - Upper Sorbian

  - Venetian

  - Amharic

  - Asturian

  - Tibetian

  - Bosnian

  - English GB

  - English ZA

  - Indonesian

  - Icelandic

  - Georgian

  - Khmer

  - Lao

  - Macedonian

  - Nepali

  - Oromo

  - Albanian

  - Tajik

  - Uyghur

  - Vietnamese

  - Kurdish

Try to build all languages see bsc#1096360

Make sure to install the KDE5/Qt5 UI/filepicker

Try to implement safeguarding to avoid bsc#1050305

Disable base-drivers-mysql as it needs mysqlcppcon that is only for mysql and not mariadb, causes issues bsc#1094779

  - Users can still connect using jdbc/odbc

Fix java detection on machines with too many cpus

CVE-2018-10583: An information disclosure vulnerability occured when LibreOffice automatically processed and initiated an SMB connection embedded in a malicious file, as demonstrated by xlink:href=file://192.168.0.2/test.jpg within an office:document-content element in a .odt XML document. (bsc#1091606)

libepubgen was updated to 0.1.1: Avoid <div> inside or <span>.Avoid writin vertical-align attribute without a value.

Fix generation of invalid XHTML when there is a link starting at the beginning of a footnote.

Handle relative width for images.

Fixed layout: write chapter names to improve navigation.

Support writing mode.

Start a new HTML file at every page span in addition to the splits induced by the chosen split method. This is to ensure that specified writing mode works correctly, as it is HTML attribute.

liblangtag was updated to 0.6.2: use standard function

fix leak in test

libmwaw was updated to 0.3.14: Support MS Multiplan 1.1 files

libnumbertext was update to 1.0.5: Various fixes in numerical calculations and issues reported on libreoffice tracker

libstaroffice was updated to 0.0.6: retrieve some StarMath's formula,

retrieve some charts as graphic,

retrieve some fields in sda/sdc/sdp text-boxes,

.sdw: retrieve more attachments.

libwps was updated to 0.4.9: QuattroPro: add parser to .wb3 files

Multiplan: add parser to DOS v1-v3 files

charts: try to retrieve charts in .wk*, .wq* files

QuattroPro: add parser to .wb[12] files

myspell-dictionaries was updated to 20181025: Turkish dictionary added

Updated French dictionary

xmlsec1 was updated to 1.2.26: Added xmlsec-mscng module based on Microsoft Cryptography API: Next Generation

Added support for GOST 2012 and fixed CryptoPro CSP provider for GOST R 34.10-2001 in xmlsec-mscrypto

</span>

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libreoffice to 6.0.5.2 fixes the following issues :

Security issues fixed :

CVE-2018-10583: An information disclosure vulnerability occurs during automatic processing and initiating an SMB connection embedded in a malicious file, as demonstrated by xlink:href=file://192.168.0.2/test.jpg within an office:document-content element in a .odt XML document. (bsc#1091606)

Non security issues fixed: Bugfix: Table borders appear black in LibreOffice (while white in PowerPoint) (bsc#1088262)

Bugfix: LibreOffice extension 'Language Tool' fails after Tumbleweed update (bsc#1050305)

Bugfix: libreoffice-gnome can no longer be installed in parallel to libreoffice-gtk3 as there is a potential file conflict (bsc#1096673)

Bugfix: LibreOffice Writer: Text in boxes were not visible (bsc#1094359)

Use libreoffice-gtk3 if xfce is present (bsc#1092699)

Various other bug fixes

Exporting to PPTX results in vertical labels being shown horizontally (bsc#1095639)

Table in PPTX misplaced and partly blue (bsc#1098891)

Labels in chart change (from white and other colors) to black when saving as PPTX (bsc#1088263)

Exporting to PPTX shifts arrow shapes quite a bit bsc#1095601

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security Fix(es) :

  - libreoffice: Use-after-free in     sdstor/stgstrms.cxx:StgSmallStrm class allows for denial     of service with crafted document (CVE-2018-10119)

  - libreoffice: Out of bounds write in     filter/ww8/ww8toolbar.cxx:SwCTBWrapper class allows for     denial of service with crafted document (CVE-2018-10120)

  - libreoffice: Information disclosure via SMB connection     embedded in malicious file (CVE-2018-10583)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:3054 advisory.

    LibreOffice is an open source, community-developed office productivity suite. It includes key desktop     applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a     drawing program. LibreOffice replaces OpenOffice and provides a similar but enhanced and extended office     suite.

    Security Fix(es):

    * libreoffice: Use-after-free in sdstor/stgstrms.cxx:StgSmallStrm class allows for denial of service with     crafted document (CVE-2018-10119)

    * libreoffice: Out of bounds write in filter/ww8/ww8toolbar.cxx:SwCTBWrapper class allows for denial of     service with crafted document (CVE-2018-10120)

    * libreoffice: Information disclosure via SMB connection embedded in malicious file (CVE-2018-10583)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.6 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for libreoffice to 6.0.5.2 fixes the following issues :

Security issues fixed :

  - CVE-2018-10583: An information disclosure vulnerability     occurs during automatic processing and initiating an SMB     connection embedded in a malicious file, as demonstrated     by xlink:href=file://192.168.0.2/test.jpg within an     office:document-content element in a .odt XML document.
    (bsc#1091606)

Non security issues fixed :

  - Bugfix: Table borders appear black in LibreOffice (while     white in PowerPoint) (bsc#1088262)

  - Bugfix: LibreOffice extension 'Language Tool' fails     after Tumbleweed update (bsc#1050305)

  - Bugfix: libreoffice-gnome can no longer be installed in     parallel to libreoffice-gtk3 as there is a potential     file conflict (bsc#1096673)

  - Bugfix: LibreOffice Writer: Text in boxes were not     visible (bsc#1094359)

  - Use libreoffice-gtk3 if xfce is present (bsc#1092699)

  - Various other bug fixes

  - Exporting to PPTX results in vertical labels being shown     horizontally (bsc#1095639)

  - Table in PPTX misplaced and partly blue (bsc#1098891)

  - Labels in chart change (from white and other colors) to     black when saving as PPTX (bsc#1088263)

  - Exporting to PPTX shifts arrow shapes quite a bit     bsc#1095601 

This update was imported from the SUSE:SLE-12-SP3:Update update project.

This update for libreoffice to 6.0.5.2 fixes the following issues:
Security issues fixed :

  - CVE-2018-10583: An information disclosure vulnerability     occurs during automatic processing and initiating an SMB     connection embedded in a malicious file, as demonstrated     by xlink:href=file://192.168.0.2/test.jpg within an     office:document-content element in a .odt XML document.
    (bsc#1091606) Non security issues fixed :

  - Bugfix: Table borders appear black in LibreOffice (while     white in PowerPoint) (bsc#1088262)

  - Bugfix: LibreOffice extension 'Language Tool' fails     after Tumbleweed update (bsc#1050305)

  - Bugfix: libreoffice-gnome can no longer be installed in     parallel to libreoffice-gtk3 as there is a potential     file conflict (bsc#1096673)

  - Bugfix: LibreOffice Writer: Text in boxes were not     visible (bsc#1094359)

  - Use libreoffice-gtk3 if xfce is present (bsc#1092699)

  - Various other bug fixes

  - Exporting to PPTX results in vertical labels being shown     horizontally (bsc#1095639)

  - Table in PPTX misplaced and partly blue (bsc#1098891)

  - Labels in chart change (from white and other colors) to     black when saving as PPTX (bsc#1088263)

  - Exporting to PPTX shifts arrow shapes quite a bit     bsc#1095601

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
199335	RHEL 6 : libreoffice (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
196590	RHEL 6 : libreoffice (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
144270	EulerOS 2.0 SP5 : libreoffice (EulerOS-SA-2020-2551)	Nessus	Huawei Local Security Checks	high
123372	openSUSE Security Update : LibreOffice and dependency libraries (openSUSE-2019-912)	Nessus	SuSE Local Security Checks	high
123280	openSUSE Security Update : libreoffice (openSUSE-2019-642)	Nessus	SuSE Local Security Checks	high
122857	LibreOffice < 5.4.7 or 6.x < 6.0.4 Information Disclosure	Nessus	Windows	high
122856	LibreOffice < 5.4.7 or 6.x < 6.0.4 Information Disclosure (macOS)	Nessus	MacOS X Local Security Checks	high
121640	Ubuntu 14.04 LTS / 16.04 LTS : LibreOffice vulnerabilities (USN-3883-1)	Nessus	Ubuntu Local Security Checks	critical
120601	Fedora 28 : 1:libreoffice (2018-8d3f4d7b28)	Nessus	Fedora Local Security Checks	high
120160	SUSE SLED15 / SLES15 Security Update : libepubgen, liblangtag, libmwaw, libnumbertext, libreoffice, libstaroffice, libwps, myspell-dictionaries, xmlsec1 (SUSE-SU-2018:3683-1)	Nessus	SuSE Local Security Checks	high
119551	SUSE SLED12 Security Update : libreoffice (SUSE-SU-2018:2485-2)	Nessus	SuSE Local Security Checks	high
119192	Scientific Linux Security Update : libreoffice on SL7.x x86_64 (20181030)	Nessus	Scientific Linux Local Security Checks	high
119022	openSUSE Security Update : LibreOffice and dependency libraries (openSUSE-2018-1417)	Nessus	SuSE Local Security Checks	high
118518	RHEL 7 : libreoffice (RHSA-2018:3054)	Nessus	Red Hat Local Security Checks	high
112182	openSUSE Security Update : libreoffice (openSUSE-2018-942)	Nessus	SuSE Local Security Checks	high
112181	openSUSE Security Update : libreoffice (openSUSE-2018-941)	Nessus	SuSE Local Security Checks	high
112107	SUSE SLED12 Security Update : libreoffice (SUSE-SU-2018:2485-1)	Nessus	SuSE Local Security Checks	high
109741	Fedora 27 : 1:libreoffice (2018-490f30ffa0)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2018-10583

high

Tenable Plugins

critical

critical

high

high

high

high

high

critical

high

high

high

high

high

high

high

high

high

high