CVE-2018-10583
HIGH 7.5EPSS 78.0%
An information disclosure vulnerability occurs when LibreOffice 6.0.3 and Apache OpenOffice Writer 4.1.5 automatically process and initiate an SMB connection embedded in a malicious file, as demonstrated by xlink:href=file://192.168.0.2/test.jpg within an office:document-content element in a .odt XML document.
- CVSS v3.0 NVD
- 7.5 HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS v2.0 NVD
- 5.0 MEDIUM
AV:N/AC:L/Au:N/C:P/I:N/A:N - EPSS
- 78.01% chance of exploitation in the next 30 days, 100th percentile
- Published
- 2018-05-01
- Updated
- 2024-08-05
Proof-of-concept exploits (4)
- http://secureyourit.co.uk/wp/2018/05/01/creating-malicious-odt-files/
- MrTaherAmine/CVE-2018-105839★ · 2018-05-03
- TaharAmine/CVE-2018-105839★ · 2018-05-03
- octodi/CVE-2018-105831★ · 2024-05-13
Metasploit modules (1)
ExploitDB entries (1)
Security advisories
- http://secureyourit.co.uk/wp/2018/05/01/creating-malicious-odt-files
- https://access.redhat.com/errata/RHSA-2018:3054
- https://security-tracker.debian.org/tracker/CVE-2018-10583
- https://usn.ubuntu.com/3883-1