The SwCTBWrapper::Read function in sw/source/filter/ww8/ww8toolbar.cxx in LibreOffice before 5.4.6.1 and 6.x before 6.0.2.1 does not validate a customizations index, which allows remote attackers to cause a denial of service (heap-based buffer overflow with write access) or possibly have unspecified other impact via a crafted document that contains a certain Microsoft Word record.
The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.
| Link | Tags |
|---|---|
| https://gerrit.libreoffice.org/#/c/49499/ | patch vendor advisory |
| https://gerrit.libreoffice.org/#/c/49486/ | patch vendor advisory |
| https://gerrit.libreoffice.org/gitweb?p=core.git%3Ba=commit%3Bh=017fcc2fcd00af17a97bd5463d89662404f57667 | |
| https://access.redhat.com/errata/RHSA-2018:3054 | third party advisory vendor advisory |
| https://www.debian.org/security/2018/dsa-4178 | third party advisory vendor advisory |
| https://usn.ubuntu.com/3883-1/ | third party advisory vendor advisory |
| https://lists.debian.org/debian-lts-announce/2018/04/msg00021.html | third party advisory mailing list |
| https://www.libreoffice.org/about-us/security/advisories/cve-2018-10120/ | vendor advisory |
| https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=6173 | third party advisory |
| https://gerrit.libreoffice.org/#/c/49500/ | patch vendor advisory |