CVE-2018-10583 Information disclosure in n/a
Attackers can disclose sensitive information by tricking users into opening malicious documents that trigger automatic SMB connections.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-10583?
CVE-2018-10583 is a high-severity vulnerability in Apache Openoffice, published on 1 May 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An information disclosure vulnerability occurs when LibreOffice 6.0.3 and Apache OpenOffice Writer 4.1.5 automatically process and initiate an SMB connection embedded in a malicious file, as demonstrated by xlink:href=file://192.168.0.2/test.jpg within an office:document-content element in a .odt XML document.
Weakness: CWE-200
Which versions are affected by CVE-2018-10583?
It affects 7 products.
Linux distribution packages (18)
libreoffice SUSE:Linux Enterprise Desktop 12 SP3 | All versions | 6.0.5.2-43.38.5 |
libreoffice SUSE:Linux Enterprise Desktop 12 SP4 | All versions | 6.0.5.2-43.38.5 |
myspell-dictionaries SUSE:Linux Enterprise Module for Basesystem 15 | All versions | 20181025-3.6.1 |
xmlsec1 SUSE:Linux Enterprise Module for Package Hub 15 | All versions | 1.2.26-3.3.1 |
libreoffice SUSE:Linux Enterprise Software Development Kit 12 SP3 | All versions | 6.0.5.2-43.38.5 |
libreoffice SUSE:Linux Enterprise Software Development Kit 12 SP4 | All versions | 6.0.5.2-43.38.5 |
libreoffice SUSE:Linux Enterprise Workstation Extension 12 SP3 | All versions | 6.0.5.2-43.38.5 |
libreoffice SUSE:Linux Enterprise Workstation Extension 12 SP4 | All versions | 6.0.5.2-43.38.5 |
libepubgen SUSE:Linux Enterprise Workstation Extension 15 | All versions | 0.1.1-3.3.1 |
liblangtag SUSE:Linux Enterprise Workstation Extension 15 | All versions | 0.6.2-3.3.1 |
libmwaw SUSE:Linux Enterprise Workstation Extension 15 | All versions | 0.3.14-4.3.1 |
libnumbertext SUSE:Linux Enterprise Workstation Extension 15 | All versions | 1.0.5-1.3.1 |
libreoffice SUSE:Linux Enterprise Workstation Extension 15 | All versions | 6.0.5.2-3.3.5 |
libreoffice SUSE:Linux Enterprise Workstation Extension 15 | All versions | 6.1.3.2-3.7.3 |
libstaroffice SUSE:Linux Enterprise Workstation Extension 15 | All versions | 0.0.6-3.3.1 |
libwps SUSE:Linux Enterprise Workstation Extension 15 | All versions | 0.4.9-3.3.1 |
myspell-dictionaries SUSE:Linux Enterprise Workstation Extension 15 | All versions | 20181025-3.6.1 |
xmlsec1 SUSE:Linux Enterprise Workstation Extension 15 | All versions | 1.2.26-3.3.1 |
Products include Apache Openoffice, Canonical Ubuntu Linux, Debian Debian Linux, Libreoffice Libreoffice, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Server and 1 more.
How do I fix CVE-2018-10583?
Apply the vendor's patch.
Is CVE-2018-10583 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2018-10583 exists.
Public exploit code: 1 Metasploit module, 1 Exploit-DB entry and 2 proofs of concept on GitHub.
Other vulnerabilities in Apache Openoffice
Sources
Also known as DEBIAN-CVE-2018-10583, GHSA-hc7m-8pgf-jwrh, SUSE-SU-2018:2485-1, SUSE-SU-2018:2485-2, SUSE-SU-2018:2535-1, SUSE-SU-2018:3683-1 and 1 more.