CVE-2018-11790
When loading a document with Apache Open Office 4.1.5 and earlier with smaller end line...
When loading a document with Apache Open Office 4.1.5 and earlier with smaller end line termination than the operating system uses, the defect occurs. In this case OpenOffice runs into an Arithmetic Overflow at a string length calculation.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
7.8
When loading a document with Apache Open Office 4.1.5 and earlier with smaller end line termination than the operating system uses, the defect occurs. In this case OpenOffice runs into an Arithmetic Overflow at a string length calculation.
- Record
CVE-2018-11790- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 4.6 Medium
AV:L/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-682
- Updated
- 2026-11-02
CVE List No score
When loading a document with Apache Open Office 4.1.5 and earlier with smaller end line termination than the operating system uses, the defect occurs. In this case OpenOffice runs into an Arithmetic Overflow at a string length calculation.
- Record
CVE-2018-11790- Updated
- 2026-11-02
EUVDEUVD-2018-3789 No score
When loading a document with Apache Open Office 4.1.5 and earlier with smaller end line termination than the operating system uses, the defect occurs. In this case OpenOffice runs into an Arithmetic Overflow at a string length calculation.
- Record
EUVD-2018-3789- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jv89-hcw9-2wwr
7.8
When loading a document with Apache Open Office 4.1.5 and earlier with smaller end line...
When loading a document with Apache Open Office 4.1.5 and earlier with smaller end line termination than the operating system uses, the defect occurs. In this case OpenOffice runs into an Arithmetic Overflow at a string length calculation.
- Record
GHSA-jv89-hcw9-2wwr- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-682
- Updated
- 2026-11-02
OSV
7.8
When loading a document with Apache Open Office 4.1.5 and earlier with smaller end line termination than the operating system uses, the defect occurs. In this case OpenOffice runs into an Arithmetic Overflow at a string length calculation.
- Record
CVE-2018-11790- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2018-11790
7.8
When loading a document with Apache Open Office 4.1.5 and earlier with smaller end line termination than the operating system uses, the defect occurs. In this case OpenOffice runs into an Arithmetic Overflow at a string length calculation.
- Record
DEBIAN-CVE-2018-11790- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-11790
7.8
When loading a document with Apache Open Office 4.1.5 and earlier with smaller end line termination than the operating system uses, the defect occurs. In this case OpenOffice runs into an Arithmetic Overflow at a string length calculation.
- Record
UBUNTU-CVE-2018-11790- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUSN-3883-1 No score
libreoffice vulnerabilities
It was discovered that LibreOffice incorrectly handled certain document files. If a user were tricked into opening a specially crafted document, a remote attacker could cause LibreOffice to crash, and possibly execute arbitrary code. (CVE-2018-10119, CVE-2018-10120, CVE-2018-11790)
It was discovered that LibreOffice incorrectly handled embedded SMB connections in document files. If a user were tricked in to opening a specially crafted document, a remote attacker could possibly exploit this to obtain sensitive information. (CVE-2018-10583)
Alex Inführ discovered that LibreOffice incorrectly handled embedded scripts in document files. If a user were tricked into opening a specially crafted document, a remote attacker could possibly execute arbitrary code. (CVE-2018-16858)
- Record
USN-3883-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libreofficeDebian:12 |
before 1:4.0.3-1 | 1:4.0.3-1 |
libreofficeDebian:13 |
before 1:4.0.3-1 | 1:4.0.3-1 |
libreofficeDebian:14 |
before 1:4.0.3-1 | 1:4.0.3-1 |
libreofficeUbuntu:14.04:LTS |
before 1:4.2.8-0ubuntu5.5, plus listed versions 1:4.1.2~rc3-0ubuntu11:4.1.2~rc3-0ubuntu21:4.1.3-0ubuntu21:4.1.3-0ubuntu31:4.2.0~rc4-0ubuntu1 Show 16 moreShow less1:4.2.0-0ubuntu11:4.2.1-0ubuntu11:4.2.3~rc2-0ubuntu11:4.2.3~rc3-0ubuntu11:4.2.3~rc3-0ubuntu21:4.2.4-0ubuntu21:4.2.6.3-0ubuntu11:4.2.7-0ubuntu11:4.2.7-0ubuntu21:4.2.8-0ubuntu21:4.2.8-0ubuntu31:4.2.8-0ubuntu41:4.2.8-0ubuntu51:4.2.8-0ubuntu5.11:4.2.8-0ubuntu5.21:4.2.8-0ubuntu5.3 |
1:4.2.8-0ubuntu5.5 |
libreofficeUbuntu:14.04:LTS From an advisory covering 5 CVEs |
before 1:4.2.8-0ubuntu5.5, plus listed versions 1:4.1.2~rc3-0ubuntu11:4.1.2~rc3-0ubuntu21:4.1.3-0ubuntu21:4.1.3-0ubuntu31:4.2.0~rc4-0ubuntu1 Show 16 moreShow less1:4.2.0-0ubuntu11:4.2.1-0ubuntu11:4.2.3~rc2-0ubuntu11:4.2.3~rc3-0ubuntu11:4.2.3~rc3-0ubuntu21:4.2.4-0ubuntu21:4.2.6.3-0ubuntu11:4.2.7-0ubuntu11:4.2.7-0ubuntu21:4.2.8-0ubuntu21:4.2.8-0ubuntu31:4.2.8-0ubuntu41:4.2.8-0ubuntu51:4.2.8-0ubuntu5.11:4.2.8-0ubuntu5.21:4.2.8-0ubuntu5.3 |
1:4.2.8-0ubuntu5.5 |
libreofficeUbuntu:16.04:LTS From an advisory covering 5 CVEs |
before 1:5.1.6~rc2-0ubuntu1~xenial6, plus listed versions 1:5.0.2-0ubuntu11:5.0.2-0ubuntu21:5.0.2-0ubuntu51:5.0.2-0ubuntu71:5.0.2-0ubuntu8 Show 12 moreShow less1:5.1.0~rc3-0ubuntu21:5.1.0-0ubuntu11:5.1.1~rc2-0ubuntu11:5.1.1-0ubuntu11:5.1.1-0ubuntu31:5.1.2-0ubuntu11:5.1.3-0ubuntu11:5.1.4-0ubuntu11:5.1.6~rc2-0ubuntu1~xenial11:5.1.6~rc2-0ubuntu1~xenial21:5.1.6~rc2-0ubuntu1~xenial31:5.1.6~rc2-0ubuntu1~xenial4 |
1:5.1.6~rc2-0ubuntu1~xenial6 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-11790 is a high vulnerability (CVSS 7.8) in Apache Openoffice, published December 31, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.03%, the 63rd percentile. Fixed in libreoffice 1:4.0.3-1.
References
openoffice.org/security/cves/CVE-2018-11790.html
usn.ubuntu.com/3883-1
securityfocus.com/bid/106803
lists.apache.org/thread.html/7394e6b5f78a878bd0c44e9bc9adf90b8cdf49e9adc0f287145aba9b%40%3Ccommits.openoffice.apache.org%3E
nvd.nist.gov/vuln/detail/CVE-2018-11790
lists.apache.org/thread.html/7394e6b5f78a878bd0c44e9bc9adf90b8cdf49e9adc0f287145aba9b@%3Ccommits.openoffice.apache.org%3E
Show 10 moreShow less
github.com/advisories/GHSA-jv89-hcw9-2wwr
security-tracker.debian.org/tracker/CVE-2018-11790
ubuntu.com/security/CVE-2018-11790
openwall.com/lists/oss-security/2019/01/16/2
ubuntu.com/security/notices/USN-3883-1
cve.org/CVERecord?id=CVE-2018-11790
ubuntu.com/security/CVE-2018-10119
ubuntu.com/security/CVE-2018-10120
ubuntu.com/security/CVE-2018-10583
ubuntu.com/security/CVE-2018-16858