Lucene search

[email protected]CVE-2018-11790

HistoryJan 31, 2019 - 4:29 p.m.

CVE-2018-11790

2019-01-3116:29:00

CWE-682

[email protected]

web.nvd.nist.gov

cve-2018-11790

apache open office

document loading

end line termination

string length calculation

security vulnerability

4.6 Medium

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.6 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

23.9%

JSON

When loading a document with Apache Open Office 4.1.5 and earlier with smaller end line termination than the operating system uses, the defect occurs. In this case OpenOffice runs into an Arithmetic Overflow at a string length calculation.

Affected configurations

Vulners

NVD

Node

apacheopenofficeRange≤4.1.5

CPENameOperatorVersion
apache:openofficeapache openofficele4.1.5

CPE	Name	Operator	Version
apache:openoffice	apache openoffice	le	4.1.5

CNA Affected

[
  {
    "product": "Apache OpenOffice",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "status": "affected",
        "version": "Apache OpenOffice 4.1.5 and earlier"
      }
    ]
  }
]