CVE-2017-12608 Memory corruption in Apache OpenOffice

What is CVE-2017-12608?

CVE-2017-12608 is a high-severity memory corruption vulnerability in Apache Openoffice, published on 20 Nov 2017. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

A vulnerability in Apache OpenOffice Writer DOC file parser before 4.1.4, and specifically in ImportOldFormatStyles, allows attackers to craft malicious documents that cause denial of service (memory corruption and application crash) potentially resulting in arbitrary code execution.

Weakness: CWE-787

Which versions are affected by CVE-2017-12608?

It affects 2 products.

Products include Apache Openoffice, Debian Debian Linux.

How do I fix CVE-2017-12608?

Upgrade to a fixed version.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2017-12608 being exploited?

There is no known exploitation of CVE-2017-12608 in the wild and no public exploit code.

Other vulnerabilities in Apache Openoffice

• CVE-2014-3524 Command injection in n/a Critical 9.3
• CVE-2010-3450 Path traversal in n/a Critical 9.3
• CVE-2010-3451 Use after free in n/a Critical 9.3
• CVE-2010-3452 Use after free in n/a Critical 9.3
• CVE-2010-3453 Memory corruption in n/a Critical 9.3

All Apache Openoffice vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2017-12608, GHSA-hwpq-wfjf-957h, UBUNTU-CVE-2017-12608.