PublicDateAtUSN: 2017-02-22
Candidate: CVE-2017-3157
PublicDate: 2017-11-20 20:29:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3157
 https://www.libreoffice.org/about-us/security/advisories/cve-2017-3157/
 https://ubuntu.com/security/notices/USN-3210-1
Description:
 By exploiting the way Apache OpenOffice before 4.1.4 renders embedded
 objects, an attacker could craft a document that allows reading in a file
 from the user's filesystem. Information could be retrieved by the attacker
 by, e.g., using hidden sections to store the information, tricking the user
 into saving the document and convincing the user to send the document back
 to the attacker. The vulnerability is mitigated by the need for the
 attacker to know the precise file path in the target system, and the need
 to trick the user into saving the document and sending it back.
Ubuntu-Description:
Notes:
Bugs:
Priority: medium
Discovered-by: Ben Hayak
Assigned-to:
CVSS:
 nvd: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N [5.5 MEDIUM]

Patches_openoffice.org:
upstream_openoffice.org: needs-triage
precise_openoffice.org: not-affected (transitional packages)
trusty_openoffice.org: DNE
trusty/esm_openoffice.org: DNE
vivid/ubuntu-core_openoffice.org: DNE
vivid/stable-phone-overlay_openoffice.org: DNE
xenial_openoffice.org: DNE
yakkety_openoffice.org: DNE
devel_openoffice.org: DNE

Patches_libreoffice:
upstream_libreoffice: needs-triage
precise_libreoffice: released (1:3.5.7-0ubuntu13)
trusty_libreoffice: released (1:4.2.8-0ubuntu5)
trusty/esm_libreoffice: DNE (trusty was released [1:4.2.8-0ubuntu5])
vivid/ubuntu-core_libreoffice: DNE
vivid/stable-phone-overlay_libreoffice: DNE
xenial_libreoffice: released (1:5.1.6~rc2-0ubuntu1~xenial1)
esm-infra/xenial_libreoffice: released (1:5.1.6~rc2-0ubuntu1~xenial1)
yakkety_libreoffice: not-affected (1:5.2.2-0ubuntu2)
devel_libreoffice: not-affected (1:5.3.0~rc3-0ubuntu2)