CVE-2018-10119

Name of the Vulnerable Software and Affected Versions LibreOffice versions prior to 5.4.5.1 LibreOffice versions 6.x prior to 6.0.1.1

Description The issue is related to the use of an incorrect integer data type in the StgSmallStrm class, which can lead to a denial of service or possibly other impacts via a crafted document using the structured storage ole2 wrapper file format. This is also associated with a use-after-free vulnerability in the SwCTBWrapper::Read function, allowing remote attackers to cause a denial of service with a specially formed file.

Recommendations For LibreOffice versions prior to 5.4.5.1, update to version 5.4.5.1 or later. For LibreOffice versions 6.x prior to 6.0.1.1, update to version 6.0.1.1 or later.