CVE-2017-12607

HIGH

Apache OpenOffice < 4.1.4 - Out-of-bounds Write in PPT File Parser

Title source: llm
STIX 2.1

Description

A vulnerability in OpenOffice's PPT file parser before 4.1.4, and specifically in PPTStyleSheet, allows attackers to craft malicious documents that cause denial of service (memory corruption and application crash) potentially resulting in arbitrary code execution.

References (6)

Core 6
Core References
Third Party Advisory vendor-advisory x_refsource_debian
https://www.debian.org/security/2017/dsa-4022
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/101585
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2017/12/msg00017.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1039734
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1039732

Scores

CVSS v3 7.8
EPSS 0.0063
EPSS Percentile 70.4%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-787
Status published
Products (4)
apache/openoffice < 4.1.4
Apache Software Foundation/Apache OpenOffice 4.0.0 to 4.1.3, and some previous releases, including some using our old OpenOffice.org brand
debian/debian_linux 7.0
debian/debian_linux 8.0
Published Nov 20, 2017
Tracked Since Feb 18, 2026