CVE-2017-7882

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

LibreOffice before 2017-03-14 has an out-of-bounds write related to the HWPFile::TagsRead function in hwpfilter/source/hwpfile.cxx.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.libreoffice.org/about-us/security/advisories/cve-2017-7882/
http://www.securityfocus.com/bid/97684Third Party Advisory, VDB Entry
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=860Issue Tracking, Patch
https://github.com/LibreOffice/core/commit/65dcd1d8195069c8c8acb3a188b8e5616c51029cIssue Tracking, Patch, Third Party Advisory
http://www.libreoffice.org/about-us/security/advisories/cve-2017-7882/
http://www.securityfocus.com/bid/97684Third Party Advisory, VDB Entry
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=860Issue Tracking, Patch
https://github.com/LibreOffice/core/commit/65dcd1d8195069c8c8acb3a188b8e5616c51029cIssue Tracking, Patch, Third Party Advisory

Timeline

Published: Apr 15, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-78848.4In Adam Kropelin adk0212 APC UPS Daemon through 3.14.14, the default installation of APCUPSD allows a local authenticated, but unprivileged,CVE-2017-78857.1Artifex jbig2dec 0.13 has a heap-based buffer over-read leading to denial of service (application crash) or disclosure of sensitive informat CVE-2017-78869.8Dolibarr ERP/CRM 4.0.4 has SQL Injection in doli/theme/eldy/style.css.php via the lang parameter.CVE-2017-78876.1Dolibarr ERP/CRM 4.0.4 has XSS in doli/societe/list.php via the sall parameter.CVE-2017-78889.8Dolibarr ERP/CRM 4.0.4 stores passwords with the MD5 algorithm, which makes brute-force attacks easier.CVE-2017-78897.8The mm subsystem in the Linux kernel through 3.2 does not properly enforce the CONFIG_STRICT_DEVMEM protection mechanism, which allows local CVE-2017-78906.5The GIF decoding function gdImageCreateFromGifCtx in gd_gif_in.c in the GD Graphics Library (aka libgd), as used in PHP before 5.6.31 and 7.CVE-2017-78916.1sourcebans-pp (SourceBans++) 1.5.4.7 has XSS in admin.comms.php via the rebanid parameter.CVE-2017-78927.5Sandstorm Cap'n Proto before 0.5.3.1 allows remote crashes related to a compiler optimization. A remote attacker can trigger a segfault in a CVE-2017-78939.8In SaltStack Salt before 2016.3.6, compromised salt-minions can impersonate the salt-master.CVE-2017-78947.8WinDjView 2.1 might allow user-assisted attackers to execute code via a crafted .djvu file, because of a "User Mode Write AV near NULL" in W CVE-2017-78959.8The NFSv2 and NFSv3 server implementations in the Linux kernel through 4.10.13 lack certain checks for the end of a buffer, which allows rem