LibreOffice before 5.4.5 and 6.x before 6.0.1 allows remote attackers to read arbitrary files via =WEBSERVICE calls in a document, which use the COM.MICROSOFT.WEBSERVICE function.

The remote NewStart CGSL host, running version MAIN 5.04, has libreoffice packages installed that are affected by a vulnerability:

  - A flaw was found in libreoffice before 5.4.5 and before     6.0.1. Arbitrary remote file disclosure may be achieved     by the use of the WEBSERVICE formula in a specially     crafted ODS file. (CVE-2018-6871)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of LibreOffice installed on the remote Windows host is either 5.x prior to 5.4.5 or 6.x prior to 6.0.1. It is, therefore, affected by the following vulnerabilities:

  - An arbitrary file read vulnerability exists in the     COM.MICROSOFT.WEBSERVICE function due to improper     validation of a URL input. An unauthenticated, remote     attacker can exploit this, via a specially crafted file,     to read arbitrary files and disclose sensitive information.
    (CVE-2018-6871)

  - A use after free vulnerability exists in the StgSmallStrm     class due to the use of a short data type. An unauthenticated,     remote attacker can exploit this, via a specially crafted     file that uses the structured storage ole2 wrapper, to     execute arbitrary code. (CVE-2018-10119)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of LibreOffice installed on the remote macOS host is either 5.x prior to 5.4.5 or 6.x prior to 6.0.1. It is, therefore, affected by the following vulnerabilities:

  - An arbitrary file read vulnerability exists in the     COM.MICROSOFT.WEBSERVICE function due to improper     validation of a URL input. An unauthenticated, remote     attacker can exploit this, via a specially crafted file,     to read arbitrary files and disclose sensitive information.
    (CVE-2018-6871)

  - A use after free vulnerability exists in the StgSmallStrm     class due to the use of a short data type. An unauthenticated,     remote attacker can exploit this, via a specially crafted     file that uses the structured storage ole2 wrapper, to     execute arbitrary code. (CVE-2018-10119)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

LibreOffice was updated to version 6.0.3. Following new features were added :

  - The Notebookbar, although still an experimental feature,     has been enriched with two new variants: Grouped Bar     Full for Writer, Calc and Impress, and Tabbed Compact     for Writer. The Special Characters dialog has been     reworked, with the addition of lists for Recent and     Favorite characters, along with a Search field. The     Customize dialog has also been redesigned, and is now     more modern and intuitive.

  - In Writer, a Form menu has been added, making it easier     to access one of the most powerful     &Atilde;&cent;&Acirc;&#128;&Acirc;&#147; and often     unknown &Atilde;&cent;&Acirc;&#128;&Acirc;&#147;
    LibreOffice features: the ability to design forms, and     create standards-compliant PDF forms. The Find toolbar     has been enhanced with a drop-down list of search types,     to speed up navigation. A new default table style has     been added, together with a new collection of table     styles to reflect evolving visual trends.

  - The Mail Merge function has been improved, and it is now     possible to use either a Writer document or an XLSX file     as data source.

  - In Calc, ODF 1.2-compliant functions SEARCHB, FINDB and     REPLACEB have been added, to improve support for the ISO     standard format. Also, a cell range selection or a     selected group of shapes (images) can be now exported in     PNG or JPG format.

  - In Impress, the default slide size has been switched to     16:9, to support the most recent form factors of screens     and projectors. As a consequence, 10 new Impress     templates have been added, and a couple of old templates     have been updated. Changes in components :

  - The old WikiHelp has been replaced by the new Help     Online system, with attractive web pages that can also     be displayed on mobile devices. In general, LibreOffice     Help has been updated both in terms of contents and     code, with other improvements due all along the life of     the LibreOffice 6 family.

  - User dictionaries now allow automatic affixation or     compounding. This is a general spell checking     improvement in LibreOffice which can speed up work for     Writer users. Instead of manually handling several forms     of a new word in a language with rich morphology or     compounding, the Hunspell spell checker can     automatically recognize a new word with affixes or     compounds, based on a     &Atilde;&cent;&Acirc;&#128;&Acirc;&#156;Grammar     By&Atilde;&cent;&Acirc;&#128;&Acirc;&#157; model.
    Security features and changes :

  - OpenPGP keys can be used to sign ODF documents on all     desktop operating systems, with experimental support for     OpenPGP-based encryption. To enable this feature, users     will have to install the specific GPG software for their     operating systems.

  - Document classification has also been improved, and     allows multiple policies (which are now exported to     OOXML files). In Writer, marking and signing are now     supported at paragraph level. Interoperability changes :

  - OOXML interoperability has been improved in several     areas: import of SmartArt and import/export of ActiveX     controls, support of embedded text documents and     spreadsheets, export of embedded videos to PPTX, export     of cross-references to DOCX, export of MailMerge fields     to DOCX, and improvements to the PPTX filter to prevent     the creation of broken files.

  - New filters for exporting Writer documents to ePub and     importing QuarkXPress files have also been added,     together with an improved filter for importing EMF+     (Enhanced Metafile Format Plus) files as used by     Microsoft Office documents. Some improvements have also     been added to the ODF export filter, making it easier     for other ODF readers to display visuals. The full blog     entry for the 6.0 release can be found here:
    &#9;https://blog.documentfoundation.org/blog/2018/01/31/     libreoffice-6/ The full release notes can be found here:
    &#9;https://wiki.documentfoundation.org/ReleaseNotes/6.0     The libraries that LibreOffice depends on also have been     udpated to their current versions.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security Fix(es) :

  - libreoffice: Remote arbitrary file disclosure     vulnerability via WEBSERVICE formula (CVE-2018-6871)

From Red Hat Security Advisory 2018:0517 :

An update for libreoffice is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a drawing program. LibreOffice replaces OpenOffice and provides a similar but enhanced and extended office suite.

Security Fix(es) :

* libreoffice: Remote arbitrary file disclosure vulnerability via WEBSERVICE formula (CVE-2018-6871)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

An update for libreoffice is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a drawing program. LibreOffice replaces OpenOffice and provides a similar but enhanced and extended office suite.

Security Fix(es) :

* libreoffice: Remote arbitrary file disclosure vulnerability via WEBSERVICE formula (CVE-2018-6871)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

An update for libreoffice is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a drawing program. LibreOffice replaces OpenOffice and provides a similar but enhanced and extended office suite.

Security Fix(es) :

* libreoffice: Remote arbitrary file disclosure vulnerability via WEBSERVICE formula (CVE-2018-6871)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

USN-3579-1 fixed a vulnerability in LibreOffice. After upgrading, it was no longer possible for LibreOffice to open documents from certain locations outside of the user's home directory. This update fixes the problem.

We apologize for the inconvenience.

Original advisory details :

It was discovered that =WEBSERVICE calls in a document could be used to read arbitrary files. If a user were tricked in to opening a specially crafted document, a remote attacker could exploit this to obtain sensitive information. (CVE-2018-6871).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

From Red Hat Security Advisory 2018:0418 :

An update for libreoffice is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a drawing program. LibreOffice replaces OpenOffice and provides a similar but enhanced and extended office suite.

Security Fix(es) :

* libreoffice: Remote arbitrary file disclosure vulnerability via WEBSERVICE formula (CVE-2018-6871)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

USN-3579-1 fixed a vulnerability in LibreOffice. After upgrading, it was no longer possible for LibreOffice to open documents from certain locations outside of the user's home directory. This update fixes the problem.

We apologize for the inconvenience.

It was discovered that =WEBSERVICE calls in a document could be used to read arbitrary files. If a user were tricked in to opening a specially crafted document, a remote attacker could exploit this to obtain sensitive information. (CVE-2018-6871).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

LibreOffice reports :

LibreOffice Calc supports a WEBSERVICE function to obtain data by URL.
Vulnerable versions of LibreOffice allow WEBSERVICE to take a local file URL (e.g file://) which can be used to inject local files into the spreadsheet without warning the user. Subsequent formulas can operate on that inserted data and construct a remote URL whose path leaks the local data to a remote attacker.

In later versions of LibreOffice without this flaw, WEBSERVICE has now been limited to accessing http and https URLs along with bringing WEBSERVICE URLs under LibreOffice Calc's link management infrastructure.

Note: This vulnerability has been identified upstream as CVE-2018-1055, but NVD/Mitre are advising it's a reservation duplicate of CVE-2018-6871 which should be used instead.

It was discovered that =WEBSERVICE calls in a document could be used to read arbitrary files. If a user were tricked in to opening a specially crafted document, a remote attacker could exploit this to obtain sensitive information. (CVE-2018-6871).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201802-06 (LibreOffice: Information disclosure)

    It was discovered that missing restrictions in the implementation of the       WEBSERVICE function in LibreOffice could result in the disclosure of       arbitrary files.
  Impact :

    A remote attacker could entice a user to open a specially crafted       document using LibreOffice, possibly resulting in the disclosure of       arbitrary files readable by the victim.
  Workaround :

    There is no known workaround at this time.

This update for libreoffice fixes the following issues: LibreOffice was updated to 5.4.5.1 :

  - CVE-2018-6871: Fixes data exposure when using WEBSERVICE     (bsc#1080249)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libreoffice fixes the following issues :

LibreOffice was updated to 5.4.5.1 :

  - CVE-2018-6871: Fixes data exposure when using WEBSERVICE     (bsc#1080249)

This update was imported from the SUSE:SLE-12-SP3:Update update project.

- CVE-2018-1055 Remote arbitrary file disclosure     vulnerability via WEBSERVICE formula

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Mikhail Klementev, Ronnie Goodrich and Andrew Krasichkov discovered that missing restrictions in the implementation of the WEBSERVICE function in LibreOffice could result in the disclosure of arbitrary files readable by the user who opens a malformed document.

ID	Name	Product	Family	Severity
127163	NewStart CGSL MAIN 5.04 : libreoffice Vulnerability (NS-SA-2019-0013)	Nessus	NewStart CGSL Local Security Checks	critical
122588	LibreOffice < 5.4.5 or 6.x < 6.0.1 Multiple Vulnerabilities	Nessus	Windows	critical
122587	LibreOffice < 5.4.5 or 6.x < 6.0.1 Multiple Vulnerabilities (macOS)	Nessus	MacOS X Local Security Checks	critical
109357	SUSE SLED12 / SLES12 Security Update : Recommended update for LibreOffice (SUSE-SU-2018:1076-1)	Nessus	SuSE Local Security Checks	critical
108365	Scientific Linux Security Update : libreoffice on SL6.x i386/x86_64 (20180313)	Nessus	Scientific Linux Local Security Checks	critical
108359	Oracle Linux 6 : libreoffice (ELSA-2018-0517)	Nessus	Oracle Linux Local Security Checks	critical
108344	CentOS 6 : libreoffice (CESA-2018:0517)	Nessus	CentOS Local Security Checks	critical
108332	RHEL 6 : libreoffice (RHSA-2018:0517)	Nessus	Red Hat Local Security Checks	critical
107274	CentOS 7 : libreoffice (CESA-2018:0418)	Nessus	CentOS Local Security Checks	critical
107215	Ubuntu 17.10 : libreoffice regression (USN-3579-3)	Nessus	Ubuntu Local Security Checks	critical
107211	Scientific Linux Security Update : libreoffice on SL7.x x86_64 (20180306)	Nessus	Scientific Linux Local Security Checks	critical
107206	Oracle Linux 7 : libreoffice (ELSA-2018-0418)	Nessus	Oracle Linux Local Security Checks	critical
107191	RHEL 7 : libreoffice (RHSA-2018:0418)	Nessus	Red Hat Local Security Checks	critical
107087	Ubuntu 17.10 : LibreOffice regression (USN-3579-2)	Nessus	Ubuntu Local Security Checks	critical
106993	FreeBSD : LibreOffice -- Remote arbitrary file disclosure vulnerability via WEBSERVICE formula (289269f1-0def-11e8-99b0-d017c2987f9a)	Nessus	FreeBSD Local Security Checks	critical
106945	Ubuntu 14.04 LTS / 16.04 LTS : LibreOffice vulnerability (USN-3579-1)	Nessus	Ubuntu Local Security Checks	critical
106887	GLSA-201802-06 : LibreOffice: Information disclosure	Nessus	Gentoo Local Security Checks	critical
106835	SUSE SLED12 Security Update : libreoffice (SUSE-SU-2018:0443-1)	Nessus	SuSE Local Security Checks	critical
106833	openSUSE Security Update : libreoffice (openSUSE-2018-162)	Nessus	SuSE Local Security Checks	critical
106823	Fedora 27 : 1:libreoffice (2018-3eb4d8e4c4)	Nessus	Fedora Local Security Checks	critical
106789	SUSE SLED12 Security Update : libreoffice (SUSE-SU-2018:0428-1)	Nessus	SuSE Local Security Checks	critical
106729	Debian DSA-4111-1 : libreoffice - security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2018-6871

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical