CVE-2017-3157: Infoleak
By exploiting the way Apache OpenOffice before 4.1.4 renders embedded objects, an attacker could craft a document that allows reading in a file from the user's filesystem. Information could be retrieved by the attacker by, e.g., using hidden sections to store the information, tricking the user into saving the document and convincing the user to send the document back to the attacker. The vulnerability is mitigated by the need for the attacker to know the precise file path in the target system, and the need to trick the user into saving the document and sending it back.
Other sources
Embedded Objects in writer and calc can contain previews of their content. A document can be crafted which contains an embedded object that is a link to an existing file on the targets system. On load the preview of the embedded object will be updated to reflect the content of the file on the target system. In the case of LibreOffice used as an online service that preview of data on the target system could be used to expose details of the environment LibreOffice is running in. In the case of LibreOffice as a standard desktop application, the preview could be concealed in hidden sections and retrieved by the attacker if the document is saved and returned to sender.
External References:
http://www.libreoffice.org/about-us/security/advisories/cve-2017-3157/
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-3157?
CVE-2017-3157 is considered a medium severity vulnerability due to the potential for information disclosure.
How do I fix CVE-2017-3157?
The recommended fix for CVE-2017-3157 is to upgrade to Apache OpenOffice version 4.1.4 or later.
What software is affected by CVE-2017-3157?
CVE-2017-3157 affects versions of Apache OpenOffice before 4.1.4, as well as various versions of LibreOffice.
Can CVE-2017-3157 allow unauthorized access to my files?
Yes, CVE-2017-3157 can allow an attacker to read files from a user's filesystem if they successfully exploit the vulnerability.
Is there a workaround for CVE-2017-3157 if I cannot update?
There is no official workaround for CVE-2017-3157; the best course of action is to apply the available updates.