Cloudanix VulnDB

CVE-2016-0794

High · 7.8

CVSS

7.8

EPSS

2.8%

Published

Feb 18, 2016

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

Older versions of a popular office program can be tricked into crashing or running bad code when someone opens a specially made document file.

Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Low
Impact
Full Compromise
Component
Application
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The lwp filter in LibreOffice before 5.0.4 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted LotusWordPro (lwp) document.

Why it matters to the business

Attackers could crash the application or execute malicious code on systems running vulnerable LibreOffice versions, risking data loss or system compromise, especially in environments using Ubuntu Linux or similar distributions with high downstream software dependencies.

How an attack unfolds

An attacker crafts a malicious LotusWordPro document and delivers it to a target, who then opens it in an unpatched LibreOffice instance, triggering memory corruption during filter processing.

How to fix it

Upgrade LibreOffice to version 5.0.4 or later; apply vendor patches for affected Ubuntu Linux distributions.

How to confirm the fix worked

Confirm LibreOffice version 5.0.4 or newer is installed; test document opening behavior with known-good and crafted lwp samples in an isolated environment.

Typical attack path

  1. Craft a malicious lwp document exploiting the filter flaw
  2. Deliver the document to the victim via email, download, or shared storage
  3. Victim opens the document in vulnerable LibreOffice on Linux or other affected platforms
  4. Memory corruption occurs leading to denial of service or potential code execution

How to detect it

Review application and system logs for LibreOffice crashes or memory errors triggered during lwp document parsing; correlate with file access events involving .lwp extensions.

What your security team should do

  • Prioritize immediate upgrade of all LibreOffice instances to 5.0.4 or later given the 10+ year exposure window
  • Restrict opening of untrusted lwp documents until patches are applied
  • Monitor for application crashes during document processing as a temporary detection measure

The record

The lwp filter in LibreOffice before 5.0.4 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted LotusWordPro (lwp) document.

Affected packages

Ecosystem Package Introduced Fixed
Debian:11 libreoffice 0 1:5.0.5~rc1-1
Debian:12 libreoffice 0 1:5.0.5~rc1-1
Debian:13 libreoffice 0 1:5.0.5~rc1-1
Debian:7 libreoffice 0 1:3.5.4+dfsg2-0+deb7u6
Debian:8 libreoffice 0 1:4.3.3-2+deb8u3
Mageia:5 libreoffice 0 4.4.7.2-2.mga5
Red Hat:enterprise_linux:7::client autocorr-af 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client autocorr-bg 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client autocorr-ca 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client autocorr-cs 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client autocorr-da 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client autocorr-de 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client autocorr-en 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client autocorr-es 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client autocorr-fa 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client autocorr-fi 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client autocorr-fr 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client autocorr-ga 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client autocorr-hr 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client autocorr-hu 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client autocorr-is 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client autocorr-it 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client autocorr-ja 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client autocorr-ko 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client autocorr-lb 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client autocorr-lt 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client autocorr-mn 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client autocorr-nl 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client autocorr-pl 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client autocorr-pt 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client autocorr-ro 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client autocorr-ru 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client autocorr-sk 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client autocorr-sl 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client autocorr-sr 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client autocorr-sv 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client autocorr-tr 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client autocorr-vi 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client autocorr-zh 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libcmis 0 0:0.5.1-2.el7
Red Hat:enterprise_linux:7::client libcmis-debuginfo 0 0:0.5.1-2.el7
Red Hat:enterprise_linux:7::client libcmis-devel 0 0:0.5.1-2.el7
Red Hat:enterprise_linux:7::client libcmis-tools 0 0:0.5.1-2.el7
Red Hat:enterprise_linux:7::client libpagemaker 0 0:0.0.3-1.el7
Red Hat:enterprise_linux:7::client libpagemaker-debuginfo 0 0:0.0.3-1.el7
Red Hat:enterprise_linux:7::client libpagemaker-devel 0 0:0.0.3-1.el7
Red Hat:enterprise_linux:7::client libpagemaker-doc 0 0:0.0.3-1.el7
Red Hat:enterprise_linux:7::client libpagemaker-tools 0 0:0.0.3-1.el7
Red Hat:enterprise_linux:7::client libreoffice 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-base 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-bsh 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-calc 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-core 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-debuginfo 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-draw 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-emailmerge 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-filters 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-gdb-debug-support 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-glade 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-graphicfilter 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-impress 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-langpack-af 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-langpack-ar 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-langpack-as 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-langpack-bg 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-langpack-bn 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-langpack-br 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-langpack-ca 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-langpack-cs 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-langpack-cy 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-langpack-da 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-langpack-de 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-langpack-dz 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-langpack-el 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-langpack-en 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-langpack-es 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-langpack-et 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-langpack-eu 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-langpack-fa 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-langpack-fi 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-langpack-fr 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-langpack-ga 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-langpack-gl 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-langpack-gu 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-langpack-he 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-langpack-hi 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-langpack-hr 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-langpack-hu 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-langpack-it 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-langpack-ja 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-langpack-kk 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-langpack-kn 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-langpack-ko 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-langpack-lt 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-langpack-lv 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-langpack-mai 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-langpack-ml 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-langpack-mr 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-langpack-nb 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-langpack-nl 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-langpack-nn 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-langpack-nr 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-langpack-nso 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-langpack-or 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-langpack-pa 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-langpack-pl 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-langpack-pt-BR 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-langpack-pt-PT 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-langpack-ro 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-langpack-ru 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-langpack-si 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-langpack-sk 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-langpack-sl 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-langpack-sr 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-langpack-ss 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-langpack-st 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-langpack-sv 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-langpack-ta 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-langpack-te 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-langpack-th 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-langpack-tn 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-langpack-tr 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-langpack-ts 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-langpack-uk 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-langpack-ve 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-langpack-xh 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-langpack-zh-Hans 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-langpack-zh-Hant 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-langpack-zu 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-librelogo 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-math 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-nlpsolver 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-officebean 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-ogltrans 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-opensymbol-fonts 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-pdfimport 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-postgresql 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-pyuno 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-rhino 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-sdk 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-sdk-doc 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-ure 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-wiki-publisher 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-writer 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client libreoffice-xsltfilter 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::client mdds 0 0:0.12.1-1.el7
Red Hat:enterprise_linux:7::client mdds-devel 0 0:0.12.1-1.el7
Red Hat:enterprise_linux:7::server autocorr-af 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::server autocorr-bg 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::server autocorr-ca 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::server autocorr-cs 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::server autocorr-da 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::server autocorr-de 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::server autocorr-en 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::server autocorr-es 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::server autocorr-fa 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::server autocorr-fi 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::server autocorr-fr 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::server autocorr-ga 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::server autocorr-hr 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::server autocorr-hu 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::server autocorr-is 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::server autocorr-it 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::server autocorr-ja 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::server autocorr-ko 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::server autocorr-lb 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::server autocorr-lt 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::server autocorr-mn 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::server autocorr-nl 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::server autocorr-pl 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::server autocorr-pt 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::server autocorr-ro 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::server autocorr-ru 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::server autocorr-sk 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::server autocorr-sl 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::server autocorr-sr 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::server autocorr-sv 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::server autocorr-tr 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::server autocorr-vi 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::server autocorr-zh 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::server libcmis 0 0:0.5.1-2.el7
Red Hat:enterprise_linux:7::server libcmis-debuginfo 0 0:0.5.1-2.el7
Red Hat:enterprise_linux:7::server libcmis-devel 0 0:0.5.1-2.el7
Red Hat:enterprise_linux:7::server libcmis-tools 0 0:0.5.1-2.el7
Red Hat:enterprise_linux:7::server libpagemaker 0 0:0.0.3-1.el7
Red Hat:enterprise_linux:7::server libpagemaker-debuginfo 0 0:0.0.3-1.el7
Red Hat:enterprise_linux:7::server libpagemaker-devel 0 0:0.0.3-1.el7
Red Hat:enterprise_linux:7::server libpagemaker-doc 0 0:0.0.3-1.el7
Red Hat:enterprise_linux:7::server libpagemaker-tools 0 0:0.0.3-1.el7
Red Hat:enterprise_linux:7::server libreoffice 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::server libreoffice-base 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::server libreoffice-bsh 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::server libreoffice-calc 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::server libreoffice-core 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::server libreoffice-debuginfo 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::server libreoffice-draw 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::server libreoffice-emailmerge 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::server libreoffice-filters 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::server libreoffice-gdb-debug-support 0 1:5.0.6.2-3.el7
Red Hat:enterprise_linux:7::server libreoffice-glade 0 1:5.0.6.2-3.el7

Related vulnerabilities