7.5

CVE-2018-10583: apache openoffice

CVSS: 7.5v3.0HighModified
AliasesSUSE-SU-2018:2485-1SUSE-SU-2018:2485-2SUSE-SU-2018:2535-1
Published 01-05-2018Last modified 05-08-2024
Open JSON

Vulnerability summary

CVE-2018-10583 is a high (CVSS 7.5) vulnerability in apache openoffice. EPSS estimates a 78.01% chance of exploitation in the next 30 days, higher than 99.5% of scored vulnerabilities. 3 public exploits are recorded.

Overall risk
56/100
0100
High · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.0 (NVD)
EPSS score
78.01%
0%100%
Critical · -0.34 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits3reference, exploit-database, metasploit

Advisory lineage

Upstream 0 · Downstream 4 · Related 2
MGASA-2018-0271OPENSUSE-SU-2024:10983-1RHSA-2018:3054USN-3883-1

Timeline

  1. 01-05-2018
    PublishedVulnerability first disclosed.
  2. 05-08-2024
    Last modifiedVulnerability information updated.

Description

An information disclosure vulnerability occurs when LibreOffice 6.0.3 and Apache OpenOffice Writer 4.1.5 automatically process and initiate an SMB connection embedded in a malicious file, as demonstrated by xlink:href=file://192.168.0.2/test.jpg within an office:document-content element in a .odt XML document.

CVSS metrics

4 scores · 3 sources · 2 versions

EPSS trend

Probability

78.01%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

-0.34 pp

From 78.34% on 18-09-2026

18-09-202618-10-2026
EPSS score
78.01%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

3 found
  • referenceUnverified

    Exploit Reference (secureyourit.co.uk)

    Maturity: unknown

  • exploit-databaselocalwindowsUnverified

    LibreOffice/Open Office - '.odt' Information Disclosure

    Maturity: poc

  • MetasploitMetasploitremoteUnverified

    LibreOffice 6.03 /Apache OpenOffice 4.1.5 Malicious ODT File Generator

    auxiliary/fileformat/odt_badodt

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Suse17 products
  • libepubgen&distro=SUSE Linux Enterprise Workstation Extension 15< 0.1.1-3.3.1
  • liblangtag&distro=SUSE Linux Enterprise Workstation Extension 15< 0.6.2-3.3.1
  • libmwaw&distro=SUSE Linux Enterprise Workstation Extension 15< 0.3.14-4.3.1
  • libnumbertext&distro=SUSE Linux Enterprise Workstation Extension 15< 1.0.5-1.3.1
  • libreoffice&distro=SUSE Linux Enterprise Desktop 12 SP3< 6.0.5.2-43.38.5
Redhat3 products
Debian2 products
  • libreofficeAll versions (No fix recorded)
  • debian_linuxEOL7.0 | 8.0 | 9.0
Apache1 product
Canonical1 product
Libreoffice1 product
Ubuntu1 product
  • libreoffice< 1:4.2.8-0ubuntu5.5 | < 1:5.1.6~rc2-0ubuntu1~xenial6

7 vendors · 26 products

References

31 links
Show all 31 references