Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2017-7882: LibreOffice can be tricked to corrupt data with special HWP files
CVE-2017-7882 · published 9 years ago
Summary
Older versions of LibreOffice (before March 2017) can write outside the intended memory area when opening certain HWP document files. This could cause the program to crash or behave unpredictably. Updating LibreOffice to a newer version fixes the issue.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| libreoffice | libreoffice |
<= 5.2.6 cpe:2.3:a:libreoffice:libreoffice:*:*:*:*:*:*:*:* |
Original advisory text
LibreOffice before 2017-03-14 has an out-of-bounds write related to the HWPFile::TagsRead function in hwpfilter/source/hwpfile.cxx.
LibreOffice before 2017-03-14 has an out-of-bounds write related to the HWPFile::TagsRead function in hwpfilter/source/hwpfile.cxx.
References
- http://www.libreoffice.org/about-us/security/advisories/cve-2017-7882/
- http://www.securityfocus.com/bid/97684 Third Party Advisory VDB Entry
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=860 Issue Tracking Patch
- https://github.com/LibreOffice/core/commit/65dcd1d8195069c8c8acb3a188b8e5616c510... Issue Tracking Patch Third Party Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-787Out-of-bounds Write
Timeline
Published15 Apr 2017
Updated29 Oct 2026
First seen29 Sep 2026
Sources
CVE-2017-7882 · NVD
Track software like this
Free during beta