CVE-2017-8358
LibreOffice before 2017-03-17 has an out-of-bounds write caused by a heap-based buffer overflow...
9.8 Critical
LibreOffice before 2017-03-17 has an out-of-bounds write caused by a heap-based buffer overflow related to the ReadJPEG function in vcl/source/filter/jpeg/jpegc.cxx.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
2.18%Up 1.3 points since Apr 14, 2021
What each source reports
NVD Score used
LibreOffice before 2017-03-17 has an out-of-bounds write caused by a heap-based buffer overflow related to the ReadJPEG function in vcl/source/filter/jpeg/jpegc.cxx.
- Record
CVE-2017-8358- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-119, CWE-787
- Updated
- 2026-11-02
CVE List No score
LibreOffice before 2017-03-17 has an out-of-bounds write caused by a heap-based buffer overflow related to the ReadJPEG function in vcl/source/filter/jpeg/jpegc.cxx.
- Record
CVE-2017-8358- Updated
- 2026-11-02
EUVDEUVD-2017-17318 No score
LibreOffice before 2017-03-17 has an out-of-bounds write caused by a heap-based buffer overflow related to the ReadJPEG function in vcl/source/filter/jpeg/jpegc.cxx.
- Record
EUVD-2017-17318- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vw4f-g2ch-x868
LibreOffice before 2017-03-17 has an out-of-bounds write caused by a heap-based buffer overflow...
LibreOffice before 2017-03-17 has an out-of-bounds write caused by a heap-based buffer overflow related to the ReadJPEG function in vcl/source/filter/jpeg/jpegc.cxx.
- Record
GHSA-vw4f-g2ch-x868- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-119
- Updated
- 2026-11-02
OSV
LibreOffice before 2017-03-17 has an out-of-bounds write caused by a heap-based buffer overflow related to the ReadJPEG function in vcl/source/filter/jpeg/jpegc.cxx.
- Record
CVE-2017-8358- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10983-1 No score
libreoffice-7.1.5.2-3.13 on GA media
These are all security issues fixed in the libreoffice-7.1.5.2-3.13 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10983-1- Updated
- 2026-11-02
OSVSUSE-SU-2017:1821-1 No score
Security update for libreoffice
LibreOffice was updated to version 5.3.3.2, bringing new features and enhancements:
Writer:
- New 'Go to Page' dialog for quickly jumping to another page.
- Support for 'Table Styles'.
- New drawing tools were added.
- Improvements in the toolbar.
- Borderless padding is displayed.
Calc:
- New drawing tools were added.
- In new installations the default setting for new documents is now 'Enable wildcards in formulas' instead of regular expressions.
- Improved compatibility with ODF 1.2
Impress:
- Images inserted via 'Photo Album' can now be linked instead of embedded in the document.
- When launching Impress, a Template Selector allows you to choose a Template to start with.
- Two new default templates: Vivid and Pencil.
- All existing templates have been improved.
Draw:
- New arrow endings, including Crow's foot notation's ones.
Base:
- Firebird has been upgraded to version 3.0.0. It is unable to read back Firebird 2.5 data, so embedded Firebird odb files created in LibreOffice version up to 5.2 cannot be opened with LibreOffice 5.3.
Some security issues have also been fixed:
- CVE-2017-7870: An out-of-bounds write caused by a heap-based buffer overflow related to the tools::Polygon::Insert function.
- CVE-2017-7882: An out-of-bounds write related to the HWPFile::TagsRead function.
- CVE-2017-8358: an out-of-bounds write caused by a heap-based buffer overflow related to the ReadJPEG function.
- CVE-2016-10327: An out-of-bounds write caused by a heap-based buffer overflow related to the EnhWMFReader::ReadEnhWMF function.
- CVE-2017-9433: An out-of-bounds write caused by a heap-based buffer overflow related to the MsWrd1Parser::readFootnoteCorrespondance function in libmwaw.
A comprehensive list of new features and changes in this release is available at: https://wiki.documentfoundation.org/ReleaseNotes/5.3
- Record
SUSE-SU-2017:1821-1- Updated
- 2026-11-02
OSVSUSE-SU-2017:2315-1 No score
Security update for libreoffice
LibreOffice was updated to version 5.3.5.2, bringing new features and enhancements:
Writer:
- New 'Go to Page' dialog for quickly jumping to another page.
- Support for 'Table Styles'.
- New drawing tools were added.
- Improvements in the toolbar.
- Borderless padding is displayed.
Calc:
- New drawing tools were added.
- In new installations the default setting for new documents is now 'Enable wildcards in formulas' instead of regular expressions.
- Improved compatibility with ODF 1.2
Impress:
- Images inserted via 'Photo Album' can now be linked instead of embedded in the document.
- When launching Impress, a Template Selector allows you to choose a Template to start with.
- Two new default templates: Vivid and Pencil.
- All existing templates have been improved.
Draw:
- New arrow endings, including Crow's foot notation's ones.
Base:
- Firebird has been upgraded to version 3.0.0. It is unable to read back Firebird 2.5 data, so embedded Firebird odb files created in LibreOffice version up to 5.2 cannot be opened with LibreOffice 5.3.
Some security issues have also been fixed:
- CVE-2017-7870: An out-of-bounds write caused by a heap-based buffer overflow related to the tools::Polygon::Insert function.
- CVE-2017-7882: An out-of-bounds write related to the HWPFile::TagsRead function.
- CVE-2017-8358: an out-of-bounds write caused by a heap-based buffer overflow related to the ReadJPEG function.
- CVE-2016-10327: An out-of-bounds write caused by a heap-based buffer overflow related to the EnhWMFReader::ReadEnhWMF function.
- CVE-2017-9433: An out-of-bounds write caused by a heap-based buffer overflow related to the MsWrd1Parser::readFootnoteCorrespondance function in libmwaw.
A comprehensive list of new features and changes in this release is available at: https://wiki.documentfoundation.org/ReleaseNotes/5.3
- Record
SUSE-SU-2017:2315-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libixionSUSE:Linux Enterprise Desktop 12 SP2 From an advisory covering 7 CVEs |
before 0.12.1-12.1 | 0.12.1-12.1 |
libmwawSUSE:Linux Enterprise Desktop 12 SP2 From an advisory covering 7 CVEs |
before 0.3.11-9.1 | 0.3.11-9.1 |
liborcusSUSE:Linux Enterprise Desktop 12 SP2 From an advisory covering 7 CVEs |
before 0.12.1-12.1 | 0.12.1-12.1 |
libreofficeSUSE:Linux Enterprise Desktop 12 SP2 From an advisory covering 7 CVEs |
before 5.3.3.2-40.5.9 | 5.3.3.2-40.5.9 |
libstarofficeSUSE:Linux Enterprise Desktop 12 SP2 From an advisory covering 7 CVEs |
before 0.0.3-2.1 | 0.0.3-2.1 |
libzmfSUSE:Linux Enterprise Desktop 12 SP2 From an advisory covering 7 CVEs |
before 0.0.1-2.1 | 0.0.1-2.1 |
myspell-dictionariesSUSE:Linux Enterprise Desktop 12 SP2 From an advisory covering 7 CVEs |
before 20170511-15.1 | 20170511-15.1 |
libixionSUSE:Linux Enterprise Software Development Kit 12 SP2 From an advisory covering 7 CVEs |
before 0.12.1-12.1 | 0.12.1-12.1 |
libmwawSUSE:Linux Enterprise Software Development Kit 12 SP2 From an advisory covering 7 CVEs |
before 0.3.11-9.1 | 0.3.11-9.1 |
liborcusSUSE:Linux Enterprise Software Development Kit 12 SP2 From an advisory covering 7 CVEs |
before 0.12.1-12.1 | 0.12.1-12.1 |
Show 27 moreShow less
| Package | Affected | Fixed |
|---|---|---|
libreofficeSUSE:Linux Enterprise Software Development Kit 12 SP2 From an advisory covering 7 CVEs |
before 5.3.3.2-40.5.9 | 5.3.3.2-40.5.9 |
libixionSUSE:Linux Enterprise Workstation Extension 12 SP2 From an advisory covering 7 CVEs |
before 0.12.1-12.1 | 0.12.1-12.1 |
libmwawSUSE:Linux Enterprise Workstation Extension 12 SP2 From an advisory covering 7 CVEs |
before 0.3.11-9.1 | 0.3.11-9.1 |
liborcusSUSE:Linux Enterprise Workstation Extension 12 SP2 From an advisory covering 7 CVEs |
before 0.12.1-12.1 | 0.12.1-12.1 |
libreofficeSUSE:Linux Enterprise Workstation Extension 12 SP2 From an advisory covering 7 CVEs |
before 5.3.3.2-40.5.9 | 5.3.3.2-40.5.9 |
libstarofficeSUSE:Linux Enterprise Workstation Extension 12 SP2 From an advisory covering 7 CVEs |
before 0.0.3-2.1 | 0.0.3-2.1 |
libzmfSUSE:Linux Enterprise Workstation Extension 12 SP2 From an advisory covering 7 CVEs |
before 0.0.1-2.1 | 0.0.1-2.1 |
myspell-dictionariesSUSE:Linux Enterprise Workstation Extension 12 SP2 From an advisory covering 7 CVEs |
before 20170511-15.1 | 20170511-15.1 |
libixionSUSE:Linux Enterprise Desktop 12 SP3 From an advisory covering 7 CVEs |
before 0.12.1-13.2.1 | 0.12.1-13.2.1 |
libmwawSUSE:Linux Enterprise Desktop 12 SP3 From an advisory covering 7 CVEs |
before 0.3.11-7.5.1 | 0.3.11-7.5.1 |
liborcusSUSE:Linux Enterprise Desktop 12 SP3 From an advisory covering 7 CVEs |
before 0.12.1-10.5.1 | 0.12.1-10.5.1 |
libreofficeSUSE:Linux Enterprise Desktop 12 SP3 From an advisory covering 7 CVEs |
before 5.3.5.2-43.5.4 | 5.3.5.2-43.5.4 |
libstarofficeSUSE:Linux Enterprise Desktop 12 SP3 From an advisory covering 7 CVEs |
before 0.0.3-4.1 | 0.0.3-4.1 |
libzmfSUSE:Linux Enterprise Desktop 12 SP3 From an advisory covering 7 CVEs |
before 0.0.1-4.1 | 0.0.1-4.1 |
myspell-dictionariesSUSE:Linux Enterprise Desktop 12 SP3 From an advisory covering 7 CVEs |
before 20170511-16.2.1 | 20170511-16.2.1 |
libixionSUSE:Linux Enterprise Software Development Kit 12 SP3 From an advisory covering 7 CVEs |
before 0.12.1-13.2.1 | 0.12.1-13.2.1 |
libmwawSUSE:Linux Enterprise Software Development Kit 12 SP3 From an advisory covering 7 CVEs |
before 0.3.11-7.5.1 | 0.3.11-7.5.1 |
liborcusSUSE:Linux Enterprise Software Development Kit 12 SP3 From an advisory covering 7 CVEs |
before 0.12.1-10.5.1 | 0.12.1-10.5.1 |
libreofficeSUSE:Linux Enterprise Software Development Kit 12 SP3 From an advisory covering 7 CVEs |
before 5.3.5.2-43.5.4 | 5.3.5.2-43.5.4 |
libixionSUSE:Linux Enterprise Workstation Extension 12 SP3 From an advisory covering 7 CVEs |
before 0.12.1-13.2.1 | 0.12.1-13.2.1 |
libmwawSUSE:Linux Enterprise Workstation Extension 12 SP3 From an advisory covering 7 CVEs |
before 0.3.11-7.5.1 | 0.3.11-7.5.1 |
liborcusSUSE:Linux Enterprise Workstation Extension 12 SP3 From an advisory covering 7 CVEs |
before 0.12.1-10.5.1 | 0.12.1-10.5.1 |
libreofficeSUSE:Linux Enterprise Workstation Extension 12 SP3 From an advisory covering 7 CVEs |
before 5.3.5.2-43.5.4 | 5.3.5.2-43.5.4 |
libstarofficeSUSE:Linux Enterprise Workstation Extension 12 SP3 From an advisory covering 7 CVEs |
before 0.0.3-4.1 | 0.0.3-4.1 |
libzmfSUSE:Linux Enterprise Workstation Extension 12 SP3 From an advisory covering 7 CVEs |
before 0.0.1-4.1 | 0.0.1-4.1 |
myspell-dictionariesSUSE:Linux Enterprise Workstation Extension 12 SP3 From an advisory covering 7 CVEs |
before 20170511-16.2.1 | 20170511-16.2.1 |
libreofficeopenSUSE:Tumbleweed From an advisory covering 24 CVEs |
before 7.1.5.2-3.13 | 7.1.5.2-3.13 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-8358 is a critical vulnerability (CVSS 9.8) in Libreoffice, published April 30, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.18%, the 82nd percentile. No source names a fixed version.
References
github.com/LibreOffice/core/commit/6e6e54f944a5ebb49e9110bdeff844d00a96c56c
bugs.chromium.org/p/oss-fuzz/issues/detail?id=889
securityfocus.com/bid/98395
nvd.nist.gov/vuln/detail/CVE-2017-8358
suse.com/support/update/announcement/2017/suse-su-20171821-1
Show 54 moreShow less
bugzilla.suse.com/1015115