CVE-2017-3157: Infoleak
First published: Wed Feb 22 2017(Updated: )
By exploiting the way Apache OpenOffice before 4.1.4 renders embedded objects, an attacker could craft a document that allows reading in a file from the user's filesystem. Information could be retrieved by the attacker by, e.g., using hidden sections to store the information, tricking the user into saving the document and convincing the user to send the document back to the attacker. The vulnerability is mitigated by the need for the attacker to know the precise file path in the target system, and the need to trick the user into saving the document and sending it back.
Credit: security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| debian/libreoffice | 1:6.1.5-3+deb10u7 1:6.1.5-3+deb10u10 1:7.0.4-4+deb11u7 4:7.4.7-1 4:7.5.6-1 4:7.5.8~rc1-1 | |
| redhat/libreoffice | <5.1.6 | 5.1.6 |
| redhat/libreoffice | <5.2.5 | 5.2.5 |
| redhat/libreoffice | <5.3.0 | 5.3.0 |
| Apache OpenOffice | <=4.1.3 | |
| Debian | =8.0 | |
| Debian | =9.0 | |
| Red Hat Enterprise Linux Desktop | =6.0 | |
| Red Hat Enterprise Linux Desktop | =7.0 | |
| Red Hat Enterprise Linux Server | =6.0 | |
| Red Hat Enterprise Linux Server | =7.0 | |
| Red Hat Enterprise Linux Server | =7.3 | |
| Red Hat Enterprise Linux Server | =7.4 | |
| Red Hat Enterprise Linux Server | =7.6 | |
| Red Hat Enterprise Linux Server | =7.3 | |
| Red Hat Enterprise Linux Server | =7.4 | |
| Red Hat Enterprise Linux Server | =7.5 | |
| Red Hat Enterprise Linux Server | =7.6 | |
| Red Hat Enterprise Linux Server | =7.3 | |
| Red Hat Enterprise Linux Server | =7.6 | |
| Red Hat Enterprise Linux Workstation | =6.0 | |
| Red Hat Enterprise Linux Workstation | =7.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.securityfocus.com/bid/96402
- http://www.securitytracker.com/id/1037893
- https://access.redhat.com/errata/RHSA-2017:0914
- https://access.redhat.com/errata/RHSA-2017:0979
- https://www.debian.org/security/2017/dsa-3792
- https://www.openoffice.org/security/cves/CVE-2017-3157.html
- http://www.libreoffice.org/about-us/security/advisories/cve-2017-3157/
- https://bugzilla.redhat.com/show_bug.cgi?id=1425844
- https://www.libreoffice.org/about-us/security/advisories/cve-2017-3157/
- https://security-tracker.debian.org/tracker/CVE-2017-3157
Frequently Asked Questions
What is the severity of CVE-2017-3157?
CVE-2017-3157 is considered a medium severity vulnerability due to the potential for information disclosure.
How do I fix CVE-2017-3157?
The recommended fix for CVE-2017-3157 is to upgrade to Apache OpenOffice version 4.1.4 or later.
What software is affected by CVE-2017-3157?
CVE-2017-3157 affects versions of Apache OpenOffice before 4.1.4, as well as various versions of LibreOffice.
Can CVE-2017-3157 allow unauthorized access to my files?
Yes, CVE-2017-3157 can allow an attacker to read files from a user's filesystem if they successfully exploit the vulnerability.
Is there a workaround for CVE-2017-3157 if I cannot update?
There is no official workaround for CVE-2017-3157; the best course of action is to apply the available updates.
- collector/security-tracker-debian
- agent/references
- agent/type
- agent/first-publish-date
- agent/severity
- agent/author
- agent/weakness
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2017-3157
- agent/software-canonical-lookup
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- package-manager/debian
- package-manager/redhat
- vendor/apache
- canonical/apache openoffice
- version/apache openoffice/4.1.3
- vendor/debian
- canonical/debian
- version/debian/8.0
- version/debian/9.0
- vendor/redhat
- canonical/red hat enterprise linux desktop
- version/red hat enterprise linux desktop/6.0
- version/red hat enterprise linux desktop/7.0
- canonical/red hat enterprise linux server
- version/red hat enterprise linux server/6.0
- version/red hat enterprise linux server/7.0
- version/red hat enterprise linux server/7.3
- version/red hat enterprise linux server/7.4
- version/red hat enterprise linux server/7.6
- version/red hat enterprise linux server/7.5
- canonical/red hat enterprise linux workstation
- version/red hat enterprise linux workstation/6.0
- version/red hat enterprise linux workstation/7.0