CVE-2018-14939

The get_app_path function in desktop/unx/source/start.c in LibreOffice through 6.0.5 mishandles the realpath function in certain environments such as FreeBSD…

published August 5, 2018

CVSS
—
EPSS
2%
Percentile
82.3
In the wild
Unconfirmed
What it is

⚠️ A quirky mishap in LibreOffice could lead to an unexpected crash, much like a waiter accidentally spilling soup on your laptop while you're browsing the menu! 🍲💻 Think of it like a restaurant that serves dishes without checking if the chef follows the recipe — if they mix up the ingredients, it could lead to quite the mess! In this case, LibreOffice mishandles file paths, potentially allowing chaos to ensue if the wrong 'dish' is served. An attacker could exploit this vulnerability during web browsing, leading to a denial of service as LibreOffice crashes due to a buffer overflow. Although the full extent of the impact is unspecified, it could disrupt your work and cause frustration while you try to figure out what just happened!

Put simply

Think of it like a restaurant that serves dishes without checking if the chef follows the recipe — if they mix up the ingredients, it could lead to quite the mess! In this case, LibreOffice mishandles file paths, potentially allowing chaos to ensue if the wrong 'dish' is served. The vulnerability in LibreOffice's get_app_path function mismanages the realpath function in specific environments, such as FreeBSD libc, which can lead to application crashes or possibly more severe issues when file paths are controlled by remote web sources.

What to do

An attacker could exploit this vulnerability during web browsing, leading to a denial of service as LibreOffice crashes due to a buffer overflow. Although the full extent of the impact is unspecified, it could disrupt your work and cause frustration while you try to figure out what just happened! To protect your setup, ensure LibreOffice is updated to at least version 6.0.6 or higher. Also, consider restricting automatic launches during web browsing to limit exposure. Regularly monitor security advisories for any further guidance! You've got this! With these steps, you'll keep your system running smoothly! 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02188 · 82.3th percentile
Published
2018-08-05T18:00Z
EPSS history
Timeline
  • 05 AUG 18:00Z
    The get_app_path function in desktop/unx/source/start.c in LibreOffice through 6.0.5 mishandles the realpath function in certain environments such as FreeBSD…
    cvelistv5