CVE-2017-7882
LibreOffice before 2017-03-14 has an out-of-bounds write related to the HWPFile::TagsRead...
9.8 CriticalFix available
LibreOffice before 2017-03-14 has an out-of-bounds write related to the HWPFile::TagsRead function in hwpfilter/source/hwpfile.cxx.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
2.44%Up 1.4 points since Apr 14, 2021
What each source reports
NVD Score used
LibreOffice before 2017-03-14 has an out-of-bounds write related to the HWPFile::TagsRead function in hwpfilter/source/hwpfile.cxx.
- Record
CVE-2017-7882- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-787
- Updated
- 2026-11-02
CVE List No score
LibreOffice before 2017-03-14 has an out-of-bounds write related to the HWPFile::TagsRead function in hwpfilter/source/hwpfile.cxx.
- Record
CVE-2017-7882- Updated
- 2026-11-02
EUVDEUVD-2017-16857 No score
LibreOffice before 2017-03-14 has an out-of-bounds write related to the HWPFile::TagsRead function in hwpfilter/source/hwpfile.cxx.
- Record
EUVD-2017-16857- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-h5pc-f7x5-jjj2
LibreOffice before 2017-03-14 has an out-of-bounds write related to the HWPFile::TagsRead...
LibreOffice before 2017-03-14 has an out-of-bounds write related to the HWPFile::TagsRead function in hwpfilter/source/hwpfile.cxx.
- Record
GHSA-h5pc-f7x5-jjj2- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
OSV
LibreOffice before 2017-03-14 has an out-of-bounds write related to the HWPFile::TagsRead function in hwpfilter/source/hwpfile.cxx.
- Record
CVE-2017-7882- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10983-1 No score
libreoffice-7.1.5.2-3.13 on GA media
These are all security issues fixed in the libreoffice-7.1.5.2-3.13 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10983-1- Updated
- 2026-11-02
OSVSUSE-SU-2017:1821-1 No score
Security update for libreoffice
LibreOffice was updated to version 5.3.3.2, bringing new features and enhancements:
Writer:
- New 'Go to Page' dialog for quickly jumping to another page.
- Support for 'Table Styles'.
- New drawing tools were added.
- Improvements in the toolbar.
- Borderless padding is displayed.
Calc:
- New drawing tools were added.
- In new installations the default setting for new documents is now 'Enable wildcards in formulas' instead of regular expressions.
- Improved compatibility with ODF 1.2
Impress:
- Images inserted via 'Photo Album' can now be linked instead of embedded in the document.
- When launching Impress, a Template Selector allows you to choose a Template to start with.
- Two new default templates: Vivid and Pencil.
- All existing templates have been improved.
Draw:
- New arrow endings, including Crow's foot notation's ones.
Base:
- Firebird has been upgraded to version 3.0.0. It is unable to read back Firebird 2.5 data, so embedded Firebird odb files created in LibreOffice version up to 5.2 cannot be opened with LibreOffice 5.3.
Some security issues have also been fixed:
- CVE-2017-7870: An out-of-bounds write caused by a heap-based buffer overflow related to the tools::Polygon::Insert function.
- CVE-2017-7882: An out-of-bounds write related to the HWPFile::TagsRead function.
- CVE-2017-8358: an out-of-bounds write caused by a heap-based buffer overflow related to the ReadJPEG function.
- CVE-2016-10327: An out-of-bounds write caused by a heap-based buffer overflow related to the EnhWMFReader::ReadEnhWMF function.
- CVE-2017-9433: An out-of-bounds write caused by a heap-based buffer overflow related to the MsWrd1Parser::readFootnoteCorrespondance function in libmwaw.
A comprehensive list of new features and changes in this release is available at: https://wiki.documentfoundation.org/ReleaseNotes/5.3
- Record
SUSE-SU-2017:1821-1- Updated
- 2026-11-02
OSVSUSE-SU-2017:2315-1 No score
Security update for libreoffice
LibreOffice was updated to version 5.3.5.2, bringing new features and enhancements:
Writer:
- New 'Go to Page' dialog for quickly jumping to another page.
- Support for 'Table Styles'.
- New drawing tools were added.
- Improvements in the toolbar.
- Borderless padding is displayed.
Calc:
- New drawing tools were added.
- In new installations the default setting for new documents is now 'Enable wildcards in formulas' instead of regular expressions.
- Improved compatibility with ODF 1.2
Impress:
- Images inserted via 'Photo Album' can now be linked instead of embedded in the document.
- When launching Impress, a Template Selector allows you to choose a Template to start with.
- Two new default templates: Vivid and Pencil.
- All existing templates have been improved.
Draw:
- New arrow endings, including Crow's foot notation's ones.
Base:
- Firebird has been upgraded to version 3.0.0. It is unable to read back Firebird 2.5 data, so embedded Firebird odb files created in LibreOffice version up to 5.2 cannot be opened with LibreOffice 5.3.
Some security issues have also been fixed:
- CVE-2017-7870: An out-of-bounds write caused by a heap-based buffer overflow related to the tools::Polygon::Insert function.
- CVE-2017-7882: An out-of-bounds write related to the HWPFile::TagsRead function.
- CVE-2017-8358: an out-of-bounds write caused by a heap-based buffer overflow related to the ReadJPEG function.
- CVE-2016-10327: An out-of-bounds write caused by a heap-based buffer overflow related to the EnhWMFReader::ReadEnhWMF function.
- CVE-2017-9433: An out-of-bounds write caused by a heap-based buffer overflow related to the MsWrd1Parser::readFootnoteCorrespondance function in libmwaw.
A comprehensive list of new features and changes in this release is available at: https://wiki.documentfoundation.org/ReleaseNotes/5.3
- Record
SUSE-SU-2017:2315-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libixionSUSE:Linux Enterprise Desktop 12 SP2 |
before 0.12.1-12.1 | 0.12.1-12.1 |
libmwawSUSE:Linux Enterprise Desktop 12 SP2 |
before 0.3.11-9.1 | 0.3.11-9.1 |
liborcusSUSE:Linux Enterprise Desktop 12 SP2 |
before 0.12.1-12.1 | 0.12.1-12.1 |
libreofficeSUSE:Linux Enterprise Desktop 12 SP2 |
before 5.3.3.2-40.5.9 | 5.3.3.2-40.5.9 |
libstarofficeSUSE:Linux Enterprise Desktop 12 SP2 |
before 0.0.3-2.1 | 0.0.3-2.1 |
libzmfSUSE:Linux Enterprise Desktop 12 SP2 |
before 0.0.1-2.1 | 0.0.1-2.1 |
myspell-dictionariesSUSE:Linux Enterprise Desktop 12 SP2 |
before 20170511-15.1 | 20170511-15.1 |
libixionSUSE:Linux Enterprise Software Development Kit 12 SP2 |
before 0.12.1-12.1 | 0.12.1-12.1 |
libmwawSUSE:Linux Enterprise Software Development Kit 12 SP2 |
before 0.3.11-9.1 | 0.3.11-9.1 |
liborcusSUSE:Linux Enterprise Software Development Kit 12 SP2 |
before 0.12.1-12.1 | 0.12.1-12.1 |
Show 27 moreShow less
| Package | Affected | Fixed |
|---|---|---|
libreofficeSUSE:Linux Enterprise Software Development Kit 12 SP2 |
before 5.3.3.2-40.5.9 | 5.3.3.2-40.5.9 |
libixionSUSE:Linux Enterprise Workstation Extension 12 SP2 |
before 0.12.1-12.1 | 0.12.1-12.1 |
libmwawSUSE:Linux Enterprise Workstation Extension 12 SP2 |
before 0.3.11-9.1 | 0.3.11-9.1 |
liborcusSUSE:Linux Enterprise Workstation Extension 12 SP2 |
before 0.12.1-12.1 | 0.12.1-12.1 |
libreofficeSUSE:Linux Enterprise Workstation Extension 12 SP2 |
before 5.3.3.2-40.5.9 | 5.3.3.2-40.5.9 |
libstarofficeSUSE:Linux Enterprise Workstation Extension 12 SP2 |
before 0.0.3-2.1 | 0.0.3-2.1 |
libzmfSUSE:Linux Enterprise Workstation Extension 12 SP2 |
before 0.0.1-2.1 | 0.0.1-2.1 |
myspell-dictionariesSUSE:Linux Enterprise Workstation Extension 12 SP2 |
before 20170511-15.1 | 20170511-15.1 |
libixionSUSE:Linux Enterprise Desktop 12 SP3 |
before 0.12.1-13.2.1 | 0.12.1-13.2.1 |
libmwawSUSE:Linux Enterprise Desktop 12 SP3 |
before 0.3.11-7.5.1 | 0.3.11-7.5.1 |
liborcusSUSE:Linux Enterprise Desktop 12 SP3 |
before 0.12.1-10.5.1 | 0.12.1-10.5.1 |
libreofficeSUSE:Linux Enterprise Desktop 12 SP3 |
before 5.3.5.2-43.5.4 | 5.3.5.2-43.5.4 |
libstarofficeSUSE:Linux Enterprise Desktop 12 SP3 |
before 0.0.3-4.1 | 0.0.3-4.1 |
libzmfSUSE:Linux Enterprise Desktop 12 SP3 |
before 0.0.1-4.1 | 0.0.1-4.1 |
myspell-dictionariesSUSE:Linux Enterprise Desktop 12 SP3 |
before 20170511-16.2.1 | 20170511-16.2.1 |
libixionSUSE:Linux Enterprise Software Development Kit 12 SP3 |
before 0.12.1-13.2.1 | 0.12.1-13.2.1 |
libmwawSUSE:Linux Enterprise Software Development Kit 12 SP3 |
before 0.3.11-7.5.1 | 0.3.11-7.5.1 |
liborcusSUSE:Linux Enterprise Software Development Kit 12 SP3 |
before 0.12.1-10.5.1 | 0.12.1-10.5.1 |
libreofficeSUSE:Linux Enterprise Software Development Kit 12 SP3 |
before 5.3.5.2-43.5.4 | 5.3.5.2-43.5.4 |
libixionSUSE:Linux Enterprise Workstation Extension 12 SP3 |
before 0.12.1-13.2.1 | 0.12.1-13.2.1 |
libmwawSUSE:Linux Enterprise Workstation Extension 12 SP3 |
before 0.3.11-7.5.1 | 0.3.11-7.5.1 |
liborcusSUSE:Linux Enterprise Workstation Extension 12 SP3 |
before 0.12.1-10.5.1 | 0.12.1-10.5.1 |
libreofficeSUSE:Linux Enterprise Workstation Extension 12 SP3 |
before 5.3.5.2-43.5.4 | 5.3.5.2-43.5.4 |
libstarofficeSUSE:Linux Enterprise Workstation Extension 12 SP3 |
before 0.0.3-4.1 | 0.0.3-4.1 |
libzmfSUSE:Linux Enterprise Workstation Extension 12 SP3 |
before 0.0.1-4.1 | 0.0.1-4.1 |
myspell-dictionariesSUSE:Linux Enterprise Workstation Extension 12 SP3 |
before 20170511-16.2.1 | 20170511-16.2.1 |
libreofficeopenSUSE:Tumbleweed |
before 7.1.5.2-3.13 | 7.1.5.2-3.13 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-7882 is a critical vulnerability (CVSS 9.8) in Libreoffice, published April 15, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.44%, the 84th percentile. Fixed in libixion 0.12.1-12.1.
References
bugs.chromium.org/p/oss-fuzz/issues/detail?id=860
github.com/LibreOffice/core/commit/65dcd1d8195069c8c8acb3a188b8e5616c51029c
securityfocus.com/bid/97684
libreoffice.org/about-us/security/advisories/cve-2017-7882
nvd.nist.gov/vuln/detail/CVE-2017-7882
Show 55 moreShow less
suse.com/support/update/announcement/2017/suse-su-20171821-1
bugzilla.suse.com/1015115