CVE-2018-6871

Public PoC / Exploit (2)

TrickestTrickest PoC index Exploit-DBLibreOffice < 6.0.1 - '=WEBSERVICE' Remote Arbitrary File Disclosure

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

LibreOffice before 5.4.5 and 6.x before 6.0.1 allows remote attackers to read arbitrary files via =WEBSERVICE calls in a document, which use the COM.MICROSOFT.WEBSERVICE function.

Affected Products (22)

libreoffice · libreoffice (up to 5.4.5)vulnerable

libreoffice · libreofficevulnerable

debian · debian_linuxvulnerable

canonical · ubuntu_linuxvulnerable

redhat · enterprise_linux_desktopvulnerable

redhat · enterprise_linux_servervulnerable

redhat · enterprise_linux_server_ausvulnerable

redhat · enterprise_linux_server_eusvulnerable

redhat · enterprise_linux_server_tusvulnerable

redhat · enterprise_linux_workstationvulnerable

References (16)

https://access.redhat.com/errata/RHSA-2018:0418

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:0517

Third Party Advisory

https://cgit.freedesktop.org/libreoffice/core/commit/?h=libreoffice-5-4-5&id=a916fc0c0e0e8b10cb4158fa0fa173fe205d434a

PatchThird Party Advisory

https://github.com/jollheef/libreoffice-remote-arbitrary-file-disclosure

ExploitThird Party Advisory

https://usn.ubuntu.com/3579-1/

Third Party Advisory

https://www.debian.org/security/2018/dsa-4111

Third Party Advisory

https://www.exploit-db.com/exploits/44022/

ExploitThird Party AdvisoryVDB Entry

https://www.libreoffice.org/about-us/security/advisories/cve-2018-1055/

Vendor Advisory

https://access.redhat.com/errata/RHSA-2018:0418

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:0517

Third Party Advisory

https://cgit.freedesktop.org/libreoffice/core/commit/?h=libreoffice-5-4-5&id=a916fc0c0e0e8b10cb4158fa0fa173fe205d434a

PatchThird Party Advisory

https://github.com/jollheef/libreoffice-remote-arbitrary-file-disclosure

ExploitThird Party Advisory

https://usn.ubuntu.com/3579-1/

Third Party Advisory

https://www.debian.org/security/2018/dsa-4111

Third Party Advisory

https://www.exploit-db.com/exploits/44022/

ExploitThird Party AdvisoryVDB Entry

https://www.libreoffice.org/about-us/security/advisories/cve-2018-1055/

Vendor Advisory