High severity · published Jan 31, 2019
CVE-2018-11790
When loading a document with Apache Open Office 4.1.5 and earlier with smaller end line termination than the operating system uses, the defect occurs
7.8
CVSS
1%
EPSS
No
On KEV
Description
When loading a document with Apache Open Office 4.1.5 and earlier with smaller end line termination than the operating system uses, the defect occurs. In this case OpenOffice runs into an Arithmetic Overflow at a string length calculation.
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 63% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AO
Apache OpenOffice · Apache Software Foundation
Apache OpenOffice 4.1.5 and earlier · source: vendor
OP
Openoffice · Apache
through 4.1.5 · source: NVD
UL
Ubuntu Linux · Canonical
14.04; 16.04 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-11790
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-11790
Third Party Advisory
http://www.securityfocus.com/bid/106803
lists.apache.org
https://lists.apache.org/thread.html/7394e6b5f78a878bd0c44e9bc9adf90b8cdf49e9adc0f287145aba9b%40%3Ccommits.openoffice.apache.org%3E
Third Party Advisory
https://usn.ubuntu.com/3883-1/
Patch
https://www.openoffice.org/security/cves/CVE-2018-11790.html
More from Apache OpenOffice
8.8
CVE-2026-59265
Apache OpenOffice, Apache OpenOffice: Opening a malicious document can lead to system takeover