CVE-2018-10120

Publication date 16 April 2018

Last updated 25 August 2025

Ubuntu priority

Cvss 3 Severity Score

Description

The SwCTBWrapper::Read function in sw/source/filter/ww8/ww8toolbar.cxx in LibreOffice before 5.4.6.1 and 6.x before 6.0.2.1 does not validate a customizations index, which allows remote attackers to cause a denial of service (heap-based buffer overflow with write access) or possibly have unspecified other impact via a crafted document that contains a certain Microsoft Word record.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
libreoffice	18.10 cosmic	Not affected
	18.04 LTS bionic	Not affected
	17.10 artful	Not affected
	16.04 LTS xenial	Fixed 1:5.1.6~rc2-0ubuntu1~xenial6
	14.04 LTS trusty	Fixed 1:4.2.8-0ubuntu5.5

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
libreoffice	Upstream: https://gerrit.libreoffice.org/gitweb?p=core.git;a=commit;h=017fcc2fcd00af17a97bd5463d89662404f57667 Upstream: ?h=libr

Severity score breakdown

Parameter	Value
Base score	7.8 · High
Attack vector	Local
Attack complexity	Low
Privileges required	None
User interaction	Required
Scope	Unchanged
Confidentiality	High
Integrity impact	High
Availability impact	High
Vector	CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

Related Ubuntu Security Notices (USN)

USN-3883-1
LibreOffice vulnerabilities
6 February 2019