An information disclosure vulnerability occurs when LibreOffice 6.0.3 and Apache OpenOffice Writer 4.1.5 automatically process and initiate an SMB connection embedded in a malicious file, as demonstrated by xlink:href=file://192.168.0.2/test.jpg within an office:document-content element in a .odt XML document.

According to the versions of the libreoffice packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The SwCTBWrapper::Read function in     sw/source/filter/ww8/ww8toolbar.cxx in LibreOffice     before 5.4.6.1 and 6.x before 6.0.2.1 does not validate     a customizations index, which allows remote attackers     to cause a denial of service (heap-based buffer     overflow with write access) or possibly have     unspecified other impact via a crafted document that     contains a certain Microsoft Word     record.(CVE-2018-10120)

  - An information disclosure vulnerability occurs when     LibreOffice 6.0.3 and Apache OpenOffice Writer 4.1.5     automatically process and initiate an SMB connection     embedded in a malicious file, as demonstrated by     xlink:href=file://192.168.0.2/test.jpg within an     office:document-content element in a .odt XML     document.(CVE-2018-10583)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for LibreOffice, libepubgen, liblangtag, libmwaw, libnumbertext, libstaroffice, libwps, myspell-dictionaries, xmlsec1 fixes the following issues :

LibreOffice was updated to 6.1.3.2 (fate#326624) and contains new features and lots of bugfixes :

The full changelog can be found on :

https://wiki.documentfoundation.org/ReleaseNotes/6.1

Bugfixes :

  - bsc#1095639 Exporting to PPTX results in vertical labels     being shown horizontally

  - bsc#1098891 Table in PPTX misplaced and partly blue

  - bsc#1088263 Labels in chart change (from white and other     colors) to black when saving as PPTX

  - bsc#1095601 Exporting to PPTX shifts arrow shapes quite     a bit

  - Add more translations :

  - Belarusian

  - Bodo

  - Dogri

  - Frisian

  - Gaelic

  - Paraguayan_Guaran

  - Upper_Sorbian

  - Konkani

  - Kashmiri

  - Luxembourgish

  - Monglolian

  - Manipuri

  - Burnese

  - Occitan

  - Kinyarwanda

  - Santali

  - Sanskrit

  - Sindhi

  - Sidamo

  - Tatar

  - Uzbek

  - Upper Sorbian

  - Venetian

  - Amharic

  - Asturian

  - Tibetian

  - Bosnian

  - English GB

  - English ZA

  - Indonesian

  - Icelandic

  - Georgian

  - Khmer

  - Lao

  - Macedonian

  - Nepali

  - Oromo

  - Albanian

  - Tajik

  - Uyghur

  - Vietnamese

  - Kurdish

  - Try to build all languages see bsc#1096360

  - Make sure to install the KDE5/Qt5 UI/filepicker

  - Try to implement safeguarding to avoid bsc#1050305

  - Disable base-drivers-mysql as it needs mysqlcppcon that     is only for mysql and not mariadb, causes issues     bsc#1094779

  - Users can still connect using jdbc/odbc

  - Fix java detection on machines with too many cpus

  - CVE-2018-10583: An information disclosure vulnerability     occured when LibreOffice automatically processed and     initiated an SMB connection embedded in a malicious     file, as demonstrated by     xlink:href=file://192.168.0.2/test.jpg within an     office:document-content element in a .odt XML document.
    (bsc#1091606)

libepubgen was updated to 0.1.1 :

  - Avoid <div> inside <p> or <span>.

  - Avoid writin vertical-align attribute without a value.

  - Fix generation of invalid XHTML when there is a link     starting at the beginning of a footnote.

  - Handle relative width for images.

  - Fixed layout: write chapter names to improve navigation.

  - Support writing mode.

  - Start a new HTML file at every page span in addition to     the splits induced by the chosen split method. This is     to ensure that specified writing mode works correctly,     as it is HTML <body> attribute.

liblangtag was updated to 0.6.2 :

  - use standard function

  - fix leak in test

libmwaw was updated to 0.3.14 :

  - Support MS Multiplan 1.1 files

libnumbertext was update to 1.0.5 :

  - Various fixes in numerical calculations and issues     reported on libreoffice tracker

libstaroffice was updated to 0.0.6 :

  - retrieve some StarMath's formula,

  - retrieve some charts as graphic,

  - retrieve some fields in sda/sdc/sdp text-boxes,

  - .sdw: retrieve more attachments.

libwps was updated to 0.4.9 :

  - QuattroPro: add parser to .wb3 files

  - Multiplan: add parser to DOS v1-v3 files

  - charts: try to retrieve charts in .wk*, .wq* files

  - QuattroPro: add parser to .wb[12] files

myspell-dictionaries was updated to 20181025 :

  - Turkish dictionary added

  - Updated French dictionary

xmlsec1 was updated to 1.2.26 :

  - Added xmlsec-mscng module based on Microsoft     Cryptography API: Next Generation

  - Added support for GOST 2012 and fixed CryptoPro CSP     provider for GOST R 34.10-2001 in xmlsec-mscrypto

This update was imported from the SUSE:SLE-15:Update update project.

This update for libreoffice to 6.0.5.2 fixes the following issues :

Security issues fixed :

  - CVE-2018-10583: An information disclosure vulnerability     occurs during automatic processing and initiating an SMB     connection embedded in a malicious file, as demonstrated     by xlink:href=file://192.168.0.2/test.jpg within an     office:document-content element in a .odt XML document.
    (bsc#1091606)

Non security issues fixed :

  - Bugfix: Table borders appear black in LibreOffice (while     white in PowerPoint) (bsc#1088262)

  - Bugfix: LibreOffice extension 'Language Tool' fails     after Tumbleweed update (bsc#1050305)

  - Bugfix: libreoffice-gnome can no longer be installed in     parallel to libreoffice-gtk3 as there is a potential     file conflict (bsc#1096673)

  - Bugfix: LibreOffice Writer: Text in boxes were not     visible (bsc#1094359)

  - Use libreoffice-gtk3 if xfce is present (bsc#1092699)

  - Various other bug fixes

This update was imported fromm the SUSE:SLE-15:Update update project.

The version of LibreOffice installed on the remote Windows host is either prior to 5.4.7 or 6.x prior to 6.0.4. It is, therefore, affected by an information disclosure vulnerability that exists in documents containing an embedded SMB link due to automatic initiation of image retrieval. An unauthenticated, remote attacker can exploit this, via an SMB connection embedded in a malicious file, to disclose potentially sensitive information.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It was discovered that LibreOffice incorrectly handled certain document files. If a user were tricked into opening a specially crafted document, a remote attacker could cause LibreOffice to crash, and possibly execute arbitrary code. (CVE-2018-10119, CVE-2018-10120, CVE-2018-11790)

It was discovered that LibreOffice incorrectly handled embedded SMB connections in document files. If a user were tricked in to opening a specially crafted document, a remote attacker could possibly exploit this to obtain sensitive information. (CVE-2018-10583)

Alex Infuhr discovered that LibreOffice incorrectly handled embedded scripts in document files. If a user were tricked into opening a specially crafted document, a remote attacker could possibly execute arbitrary code. (CVE-2018-16858).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- CVE-2018-10583 A LibreOffice document with a linked     image, which is on a samba share, will cause LibreOffice     to automatically initiate a samba connection to retrieve     the image. This is by design. If end users or     administrators wish to disable this functionality this     can now be disabled via     tools->options->security->options->block any links from     documents not among the trusted locations.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for LibreOffice, libepubgen, liblangtag, libmwaw, libnumbertext, libstaroffice, libwps, myspell-dictionaries, xmlsec1 fixes the following issues :

LibreOffice was updated to 6.1.3.2 (fate#326624) and contains new features and lots of bugfixes :

The full changelog can be found on :

https://wiki.documentfoundation.org/ReleaseNotes/6.1

Bugfixes :

bsc#1095639 Exporting to PPTX results in vertical labels being shown horizontally

bsc#1098891 Table in PPTX misplaced and partly blue

bsc#1088263 Labels in chart change (from white and other colors) to black when saving as PPTX

bsc#1095601 Exporting to PPTX shifts arrow shapes quite a bit

Add more translations :

  - Belarusian

  - Bodo

  - Dogri

  - Frisian

  - Gaelic

  - Paraguayan_Guaran

  - Upper_Sorbian

  - Konkani

  - Kashmiri

  - Luxembourgish

  - Monglolian

  - Manipuri

  - Burnese

  - Occitan

  - Kinyarwanda

  - Santali

  - Sanskrit

  - Sindhi

  - Sidamo

  - Tatar

  - Uzbek

  - Upper Sorbian

  - Venetian

  - Amharic

  - Asturian

  - Tibetian

  - Bosnian

  - English GB

  - English ZA

  - Indonesian

  - Icelandic

  - Georgian

  - Khmer

  - Lao

  - Macedonian

  - Nepali

  - Oromo

  - Albanian

  - Tajik

  - Uyghur

  - Vietnamese

  - Kurdish

Try to build all languages see bsc#1096360

Make sure to install the KDE5/Qt5 UI/filepicker

Try to implement safeguarding to avoid bsc#1050305

Disable base-drivers-mysql as it needs mysqlcppcon that is only for mysql and not mariadb, causes issues bsc#1094779

  - Users can still connect using jdbc/odbc

Fix java detection on machines with too many cpus

CVE-2018-10583: An information disclosure vulnerability occured when LibreOffice automatically processed and initiated an SMB connection embedded in a malicious file, as demonstrated by xlink:href=file://192.168.0.2/test.jpg within an office:document-content element in a .odt XML document. (bsc#1091606)

libepubgen was updated to 0.1.1: Avoid <div> inside or <span>.Avoid writin vertical-align attribute without a value.

Fix generation of invalid XHTML when there is a link starting at the beginning of a footnote.

Handle relative width for images.

Fixed layout: write chapter names to improve navigation.

Support writing mode.

Start a new HTML file at every page span in addition to the splits induced by the chosen split method. This is to ensure that specified writing mode works correctly, as it is HTML attribute.

liblangtag was updated to 0.6.2: use standard function

fix leak in test

libmwaw was updated to 0.3.14: Support MS Multiplan 1.1 files

libnumbertext was update to 1.0.5: Various fixes in numerical calculations and issues reported on libreoffice tracker

libstaroffice was updated to 0.0.6: retrieve some StarMath's formula,

retrieve some charts as graphic,

retrieve some fields in sda/sdc/sdp text-boxes,

.sdw: retrieve more attachments.

libwps was updated to 0.4.9: QuattroPro: add parser to .wb3 files

Multiplan: add parser to DOS v1-v3 files

charts: try to retrieve charts in .wk*, .wq* files

QuattroPro: add parser to .wb[12] files

myspell-dictionaries was updated to 20181025: Turkish dictionary added

Updated French dictionary

xmlsec1 was updated to 1.2.26: Added xmlsec-mscng module based on Microsoft Cryptography API: Next Generation

Added support for GOST 2012 and fixed CryptoPro CSP provider for GOST R 34.10-2001 in xmlsec-mscrypto

</span>

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libreoffice to 6.0.5.2 fixes the following issues :

Security issues fixed :

CVE-2018-10583: An information disclosure vulnerability occurs during automatic processing and initiating an SMB connection embedded in a malicious file, as demonstrated by xlink:href=file://192.168.0.2/test.jpg within an office:document-content element in a .odt XML document. (bsc#1091606)

Non security issues fixed: Bugfix: Table borders appear black in LibreOffice (while white in PowerPoint) (bsc#1088262)

Bugfix: LibreOffice extension 'Language Tool' fails after Tumbleweed update (bsc#1050305)

Bugfix: libreoffice-gnome can no longer be installed in parallel to libreoffice-gtk3 as there is a potential file conflict (bsc#1096673)

Bugfix: LibreOffice Writer: Text in boxes were not visible (bsc#1094359)

Use libreoffice-gtk3 if xfce is present (bsc#1092699)

Various other bug fixes

Exporting to PPTX results in vertical labels being shown horizontally (bsc#1095639)

Table in PPTX misplaced and partly blue (bsc#1098891)

Labels in chart change (from white and other colors) to black when saving as PPTX (bsc#1088263)

Exporting to PPTX shifts arrow shapes quite a bit bsc#1095601

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security Fix(es) :

  - libreoffice: Use-after-free in     sdstor/stgstrms.cxx:StgSmallStrm class allows for denial     of service with crafted document (CVE-2018-10119)

  - libreoffice: Out of bounds write in     filter/ww8/ww8toolbar.cxx:SwCTBWrapper class allows for     denial of service with crafted document (CVE-2018-10120)

  - libreoffice: Information disclosure via SMB connection     embedded in malicious file (CVE-2018-10583)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:3054 advisory.

  - libreoffice: Use-after-free in sdstor/stgstrms.cxx:StgSmallStrm class allows for denial of service with     crafted document (CVE-2018-10119)

  - libreoffice: Out of bounds write in filter/ww8/ww8toolbar.cxx:SwCTBWrapper class allows for denial of     service with crafted document (CVE-2018-10120)

  - libreoffice: Information disclosure via SMB connection embedded in malicious file (CVE-2018-10583)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for libreoffice to 6.0.5.2 fixes the following issues :

Security issues fixed :

  - CVE-2018-10583: An information disclosure vulnerability     occurs during automatic processing and initiating an SMB     connection embedded in a malicious file, as demonstrated     by xlink:href=file://192.168.0.2/test.jpg within an     office:document-content element in a .odt XML document.
    (bsc#1091606)

Non security issues fixed :

  - Bugfix: Table borders appear black in LibreOffice (while     white in PowerPoint) (bsc#1088262)

  - Bugfix: LibreOffice extension 'Language Tool' fails     after Tumbleweed update (bsc#1050305)

  - Bugfix: libreoffice-gnome can no longer be installed in     parallel to libreoffice-gtk3 as there is a potential     file conflict (bsc#1096673)

  - Bugfix: LibreOffice Writer: Text in boxes were not     visible (bsc#1094359)

  - Use libreoffice-gtk3 if xfce is present (bsc#1092699)

  - Various other bug fixes

  - Exporting to PPTX results in vertical labels being shown     horizontally (bsc#1095639)

  - Table in PPTX misplaced and partly blue (bsc#1098891)

  - Labels in chart change (from white and other colors) to     black when saving as PPTX (bsc#1088263)

  - Exporting to PPTX shifts arrow shapes quite a bit     bsc#1095601 

This update was imported from the SUSE:SLE-12-SP3:Update update project.

This update for libreoffice to 6.0.5.2 fixes the following issues:
Security issues fixed :

  - CVE-2018-10583: An information disclosure vulnerability     occurs during automatic processing and initiating an SMB     connection embedded in a malicious file, as demonstrated     by xlink:href=file://192.168.0.2/test.jpg within an     office:document-content element in a .odt XML document.
    (bsc#1091606) Non security issues fixed :

  - Bugfix: Table borders appear black in LibreOffice (while     white in PowerPoint) (bsc#1088262)

  - Bugfix: LibreOffice extension 'Language Tool' fails     after Tumbleweed update (bsc#1050305)

  - Bugfix: libreoffice-gnome can no longer be installed in     parallel to libreoffice-gtk3 as there is a potential     file conflict (bsc#1096673)

  - Bugfix: LibreOffice Writer: Text in boxes were not     visible (bsc#1094359)

  - Use libreoffice-gtk3 if xfce is present (bsc#1092699)

  - Various other bug fixes

  - Exporting to PPTX results in vertical labels being shown     horizontally (bsc#1095639)

  - Table in PPTX misplaced and partly blue (bsc#1098891)

  - Labels in chart change (from white and other colors) to     black when saving as PPTX (bsc#1088263)

  - Exporting to PPTX shifts arrow shapes quite a bit     bsc#1095601

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
144270	EulerOS 2.0 SP5 : libreoffice (EulerOS-SA-2020-2551)	Nessus	Huawei Local Security Checks	high
123372	openSUSE Security Update : LibreOffice and dependency libraries (openSUSE-2019-912)	Nessus	SuSE Local Security Checks	high
123280	openSUSE Security Update : libreoffice (openSUSE-2019-642)	Nessus	SuSE Local Security Checks	high
122857	LibreOffice < 5.4.7 or 6.x < 6.0.4 Information Disclosure	Nessus	Windows	high
122856	LibreOffice < 5.4.7 or 6.x < 6.0.4 Information Disclosure (macOS)	Nessus	MacOS X Local Security Checks	high
121640	Ubuntu 14.04 LTS / 16.04 LTS : LibreOffice vulnerabilities (USN-3883-1)	Nessus	Ubuntu Local Security Checks	critical
120601	Fedora 28 : 1:libreoffice (2018-8d3f4d7b28)	Nessus	Fedora Local Security Checks	high
120160	SUSE SLED15 / SLES15 Security Update : libepubgen, liblangtag, libmwaw, libnumbertext, libreoffice, libstaroffice, libwps, myspell-dictionaries, xmlsec1 (SUSE-SU-2018:3683-1)	Nessus	SuSE Local Security Checks	high
119551	SUSE SLED12 Security Update : libreoffice (SUSE-SU-2018:2485-2)	Nessus	SuSE Local Security Checks	high
119192	Scientific Linux Security Update : libreoffice on SL7.x x86_64 (20181030)	Nessus	Scientific Linux Local Security Checks	high
119022	openSUSE Security Update : LibreOffice and dependency libraries (openSUSE-2018-1417)	Nessus	SuSE Local Security Checks	high
118518	RHEL 7 : libreoffice (RHSA-2018:3054)	Nessus	Red Hat Local Security Checks	high
112182	openSUSE Security Update : libreoffice (openSUSE-2018-942)	Nessus	SuSE Local Security Checks	high
112181	openSUSE Security Update : libreoffice (openSUSE-2018-941)	Nessus	SuSE Local Security Checks	high
112107	SUSE SLED12 Security Update : libreoffice (SUSE-SU-2018:2485-1)	Nessus	SuSE Local Security Checks	high
109741	Fedora 27 : 1:libreoffice (2018-490f30ffa0)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2018-10583

high

Tenable Plugins

high

high

high

high

high

critical

high

high

high

high

high

high

high

high

high

high