Windows-only. The information disclosure is Windows automatically opening an SMB connection and sending the user's NTLM credentials when a document references file:/// (e.g. xlink:href in an .odt). On
Windows-only. The information disclosure is Windows automatically opening an SMB connection and sending the user's NTLM credentials when a document references file:/// (e.g. xlink:href in an .odt). On Linux, LibreOffice does not reach SMB for such URLs and there is no automatic NTLM authentication, so nothing is disclosed. Upstream additionally restricted such accesses to trusted locations. Debian marks this issue unimportant ("generic behaviour of accessing remote SMB shares"). https://security-tracker.debian.org/tracker/CVE-2018-10583
ECHO-a8e4-9962-ca51
Primary source · Revision 1 · Withdrawn
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:ECHO-a8e4-9962-ca51
libreoffice
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 4:25.2.3-2+deb13u6
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "4:25.2.3-2+deb13u6"
}
]
}
],
"package": {
"name": "libreoffice",
"purl": "pkg:deb/echo/libreoffice",
"ecosystem": "Echo"
},
"database_specific": {
"source": "https://advisory.echohq.com/osv/ECHO-a8e4-9962-ca51.json"
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #27764 · Revision 1
- Added to Heist Feed
- Publisher date