CVE-2018-16858 Path traversal in libreoffice
Attackers can execute arbitrary Python macros via crafted documents using directory traversal, requiring users to open malicious files in LibreOffice.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2018-16858?
CVE-2018-16858 is a high-severity path traversal vulnerability in Libreoffice Libreoffice, published on 25 Mar 2019. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
It was found that libreoffice before versions 6.0.7 and 6.1.3 was vulnerable to a directory traversal attack which could be used to execute arbitrary macros bundled with a document. An attacker could craft a document, which when opened by LibreOffice, would execute a Python method from a script in any arbitrary file system location, specified relative to the LibreOffice install location.
Which versions are affected by CVE-2018-16858?
It affects 1 product.
Linux distribution packages (40)
autocorr-af Red Hat:enterprise_linux:7::client | All versions | 1:5.3.6.1-21.el7 |
autocorr-bg Red Hat:enterprise_linux:7::client | All versions | 1:5.3.6.1-21.el7 |
autocorr-ca Red Hat:enterprise_linux:7::client | All versions | 1:5.3.6.1-21.el7 |
autocorr-cs Red Hat:enterprise_linux:7::client | All versions | 1:5.3.6.1-21.el7 |
autocorr-da Red Hat:enterprise_linux:7::client | All versions | 1:5.3.6.1-21.el7 |
autocorr-de Red Hat:enterprise_linux:7::client | All versions | 1:5.3.6.1-21.el7 |
autocorr-en Red Hat:enterprise_linux:7::client | All versions | 1:5.3.6.1-21.el7 |
autocorr-es Red Hat:enterprise_linux:7::client | All versions | 1:5.3.6.1-21.el7 |
autocorr-fa Red Hat:enterprise_linux:7::client | All versions | 1:5.3.6.1-21.el7 |
autocorr-fi Red Hat:enterprise_linux:7::client | All versions | 1:5.3.6.1-21.el7 |
autocorr-fr Red Hat:enterprise_linux:7::client | All versions | 1:5.3.6.1-21.el7 |
autocorr-ga Red Hat:enterprise_linux:7::client | All versions | 1:5.3.6.1-21.el7 |
autocorr-hr Red Hat:enterprise_linux:7::client | All versions | 1:5.3.6.1-21.el7 |
autocorr-hu Red Hat:enterprise_linux:7::client | All versions | 1:5.3.6.1-21.el7 |
autocorr-is Red Hat:enterprise_linux:7::client | All versions | 1:5.3.6.1-21.el7 |
autocorr-it Red Hat:enterprise_linux:7::client | All versions | 1:5.3.6.1-21.el7 |
autocorr-ja Red Hat:enterprise_linux:7::client | All versions | 1:5.3.6.1-21.el7 |
autocorr-ko Red Hat:enterprise_linux:7::client | All versions | 1:5.3.6.1-21.el7 |
autocorr-lb Red Hat:enterprise_linux:7::client | All versions | 1:5.3.6.1-21.el7 |
autocorr-lt Red Hat:enterprise_linux:7::client | All versions | 1:5.3.6.1-21.el7 |
autocorr-mn Red Hat:enterprise_linux:7::client | All versions | 1:5.3.6.1-21.el7 |
autocorr-nl Red Hat:enterprise_linux:7::client | All versions | 1:5.3.6.1-21.el7 |
autocorr-pl Red Hat:enterprise_linux:7::client | All versions | 1:5.3.6.1-21.el7 |
autocorr-pt Red Hat:enterprise_linux:7::client | All versions | 1:5.3.6.1-21.el7 |
autocorr-ro Red Hat:enterprise_linux:7::client | All versions | 1:5.3.6.1-21.el7 |
autocorr-ru Red Hat:enterprise_linux:7::client | All versions | 1:5.3.6.1-21.el7 |
autocorr-sk Red Hat:enterprise_linux:7::client | All versions | 1:5.3.6.1-21.el7 |
autocorr-sl Red Hat:enterprise_linux:7::client | All versions | 1:5.3.6.1-21.el7 |
autocorr-sr Red Hat:enterprise_linux:7::client | All versions | 1:5.3.6.1-21.el7 |
autocorr-sv Red Hat:enterprise_linux:7::client | All versions | 1:5.3.6.1-21.el7 |
autocorr-tr Red Hat:enterprise_linux:7::client | All versions | 1:5.3.6.1-21.el7 |
autocorr-vi Red Hat:enterprise_linux:7::client | All versions | 1:5.3.6.1-21.el7 |
autocorr-zh Red Hat:enterprise_linux:7::client | All versions | 1:5.3.6.1-21.el7 |
libreoffice Red Hat:enterprise_linux:7::client | All versions | 1:5.3.6.1-21.el7 |
libreoffice-base Red Hat:enterprise_linux:7::client | All versions | 1:5.3.6.1-21.el7 |
libreoffice-bsh Red Hat:enterprise_linux:7::client | All versions | 1:5.3.6.1-21.el7 |
libreoffice-calc Red Hat:enterprise_linux:7::client | All versions | 1:5.3.6.1-21.el7 |
libreoffice-core Red Hat:enterprise_linux:7::client | All versions | 1:5.3.6.1-21.el7 |
libreoffice-data Red Hat:enterprise_linux:7::client | All versions | 1:5.3.6.1-21.el7 |
libreoffice-debuginfo Red Hat:enterprise_linux:7::client | All versions | 1:5.3.6.1-21.el7 |
Products include Libreoffice Libreoffice.
How do I fix CVE-2018-16858?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2018-16858 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2018-16858 exists.
Public exploit code: 1 Metasploit module, 2 Exploit-DB entries and 4 proofs of concept on GitHub.
Other vulnerabilities in Libreoffice Libreoffice
Sources
Also known as DEBIAN-CVE-2018-16858, DLA-1669-1, DSA-4381-1, GHSA-v39m-j232-p3qr, MGASA-2019-0102, RHSA-2019:2130 and 5 more.