CVE-2017-12608

HIGH

Apache OpenOffice < 4.1.4 - Memory Corruption and Remote Code Execution via DOC File Parser

Title source: llm
STIX 2.1

Description

A vulnerability in Apache OpenOffice Writer DOC file parser before 4.1.4, and specifically in ImportOldFormatStyles, allows attackers to craft malicious documents that cause denial of service (memory corruption and application crash) potentially resulting in arbitrary code execution.

References (6)

Core 6
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1039735
Release Notes, Vendor Advisory x_refsource_confirm
https://www.openoffice.org/security/cves/CVE-2017-12608.html
Third Party Advisory vendor-advisory x_refsource_debian
https://www.debian.org/security/2017/dsa-4022
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/101585
Third Party Advisory mailing-list x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2017/12/msg00017.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1039733

Scores

CVSS v3 7.8
EPSS 0.0115
EPSS Percentile 78.7%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-787
Status published
Products (4)
apache/openoffice < 4.1.4
Apache Software Foundation/Apache OpenOffice 4.0.0 to 4.1.3, and some previous releases, including some using our old OpenOffice.org brand
debian/debian_linux 7.0
debian/debian_linux 8.0
Published Nov 20, 2017
Tracked Since Feb 18, 2026