Description
sot/source/sdstor/stgstrms.cxx in LibreOffice before 5.4.5.1 and 6.x before 6.0.1.1 uses an incorrect integer data type in the StgSmallStrm class, which allows remote attackers to cause a denial of service (use-after-free with write access) or possibly have unspecified other impact via a crafted document that uses the structured storage ole2 wrapper file format.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- https://gerrit.libreoffice.org/#/c/48758/ ↗
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5747 ↗
- https://access.redhat.com/errata/RHSA-2018:3054 ↗
- https://www.debian.org/security/2018/dsa-4178 ↗
- https://www.libreoffice.org/about-us/security/advisories/cve-2018-10119/ ↗
- https://usn.ubuntu.com/3883-1/ ↗
- https://gerrit.libreoffice.org/gitweb?p=core.git%3Ba=commit%3Bh=fdd41c995d1f719e92c6f083e780226114762f05 ↗
- https://gerrit.libreoffice.org/#/c/48751/ ↗
- https://lists.debian.org/debian-lts-announce/2018/04/msg00021.html ↗
- https://gerrit.libreoffice.org/#/c/48756/ ↗
- https://gerrit.libreoffice.org/#/c/48757/ ↗