CVE-2018-10119: canonical ubuntu_linux Use After Free
Vulnerability summary
CVE-2018-10119 is a high (CVSS 7.8) Use After Free vulnerability in canonical ubuntu_linux. EPSS estimates a 1.91% chance of exploitation in the next 30 days, higher than 79.4% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 7 · Related 3Timeline
- 15-04-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
sot/source/sdstor/stgstrms.cxx in LibreOffice before 5.4.5.1 and 6.x before 6.0.1.1 uses an incorrect integer data type in the StgSmallStrm class, which allows remote attackers to cause a denial of service (use-after-free with write access) or possibly have unspecified other impact via a crafted document that uses the structured storage ole2 wrapper file format.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
1.91%
Chance of exploitation in the next 30 days
Percentile
79%
Versus all other CVEs
30-day change
-0.04 pp
From 1.95% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Redhat3 products
Debian2 products
- libreoffice< 1:6.0.1-1
- debian_linuxEOL7.0 | 8.0 | 9.0
Canonical1 product
- ubuntu_linuxEOL14.04 | 16.04
Libreoffice1 product
- libreoffice< 5.4.5.1 | ≥ 6.0.0, < 6.0.1.1
Ubuntu1 product
- libreoffice< 1:4.2.8-0ubuntu5.5 | < 1:5.1.6~rc2-0ubuntu1~xenial6
5 vendors · 8 products
References
15 links
- www.libreoffice.org/about-us/security/advisories/cve-2018-10119/X Refsource MISCVendor AdvisoryREPORT
- lists.debian.org/debian-lts-announce/2018/04/msg00021.htmlMailing ListX Refsource MLISTThird Party Advisory