{"id":"CVE-2017-14226","aliases":["DEBIAN-CVE-2017-14226","EUVD-2017-5736","GHSA-4m96-cjx2-px9q","MGASA-2017-0358","SUSE-SU-2017:2931-1","UBUNTU-CVE-2017-14226","openSUSE-SU-2024:11013-1"],"status":"published","title":"WP1StylesListener.cpp, WP5StylesListener.cpp, and WP42StylesListener.cpp in libwpd 0.10.1...","description":"WP1StylesListener.cpp, WP5StylesListener.cpp, and WP42StylesListener.cpp in libwpd 0.10.1 mishandle iterators, which allows remote attackers to cause a denial of service (heap-based buffer over-read in the WPXTableList class in WPXTable.cpp). This vulnerability can be triggered in LibreOffice before 5.3.7. It may lead to suffering a remote attack against a LibreOffice application.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02481,"percentile":0.84692,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2017-09-09T08:00:00Z","modified":"2026-10-24T10:30:34Z","fixes":[{"ecosystem":"Debian:12","package":"libwpd","fixed_in":["0.10.2-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libwpd","fixed_in":["0.10.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libwpd","fixed_in":["0.10.2-1"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"libwpd","fixed_in":["0.10.2-1.mga5"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"libwpd","fixed_in":["0.10.2-1.mga6"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"libwpd","fixed_in":["0.10.2-2.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"libwpd","fixed_in":["0.10.2-2.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"libwpd","fixed_in":["0.10.2-2.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"libwpd","fixed_in":["0.10.2-2.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP2","package":"libwpd","fixed_in":["0.10.2-2.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP3","package":"libwpd","fixed_in":["0.10.2-2.4.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libwpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.2-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libwpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libwpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.2-1"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"libwpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.2-1.mga5"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"libwpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.2-1.mga6"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"libwpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.2-2.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"libwpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.2-2.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"libwpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.2-2.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"libwpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.2-2.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP2","package":"libwpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.2-2.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP3","package":"libwpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.2-2.4.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libwpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.0-2ubuntu4","0.10.1-1ubuntu1"]}],"products":[{"vendor":"libreoffice","product":"libreoffice"},{"vendor":"libwpd","product":"libwpd"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1489337","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://sourceforge.net/p/libwpd/code/ci/f40827b3eae260ce657c67d9fecc855b09dea3c3/","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://sourceforge.net/p/libwpd/code/ci/0329a9c57f9b3b0efa0f09a5235dfd90236803a5/","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://bugs.documentfoundation.org/show_bug.cgi?id=112269","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://cgit.freedesktop.org/libreoffice/core/commit/?id=dd89afa6ee8166b69e7a1e86f22616ca8fc122c9","tags":["x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://sourceforge.net/p/libwpd/tickets/14/","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-14226"},{"url":"https://sourceforge.net/p/libwpd/code/ci/0329a9c57f9b3b0efa0f09a5235dfd90236803a5"},{"url":"https://sourceforge.net/p/libwpd/code/ci/f40827b3eae260ce657c67d9fecc855b09dea3c3"},{"url":"https://sourceforge.net/p/libwpd/tickets/14"},{"url":"https://github.com/advisories/GHSA-4m96-cjx2-px9q"},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-14226","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2017-0358.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=21750","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/MTCY75EYOO4BLLLFW5MUZV6YAE5AVZTK/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20172931-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1058025","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14226","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2017-14226","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-14226","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2007-0002","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19208","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-14226","description":"WP1StylesListener.cpp, WP5StylesListener.cpp, and WP42StylesListener.cpp in libwpd 0.10.1 mishandle iterators, which allows remote attackers to cause a denial of service (heap-based buffer over-read in the WPXTableList class in WPXTable.cpp). This vulnerability can be triggered in LibreOffice before 5.3.7. It may lead to suffering a remote attack against a LibreOffice application.","status":"published","published":"2017-09-09T08:00:00Z","modified":"2024-09-16T19:10:14.18Z","updated_at":"2026-11-02T14:33:11.928814Z"}],"euvd":[{"id":"EUVD-2017-5736","description":"WP1StylesListener.cpp, WP5StylesListener.cpp, and WP42StylesListener.cpp in libwpd 0.10.1 mishandle iterators, which allows remote attackers to cause a denial of service (heap-based buffer over-read in the WPXTableList class in WPXTable.cpp). This vulnerability can be triggered in LibreOffice before 5.3.7. It may lead to suffering a remote attack against a LibreOffice application.","status":"published","published":"2017-09-09T08:00:00Z","modified":"2024-09-16T19:10:14Z","updated_at":"2026-11-03T00:55:25.778976Z"}],"ghsa":[{"id":"GHSA-4m96-cjx2-px9q","title":"WP1StylesListener.cpp, WP5StylesListener.cpp, and WP42StylesListener.cpp in libwpd 0.10.1...","description":"WP1StylesListener.cpp, WP5StylesListener.cpp, and WP42StylesListener.cpp in libwpd 0.10.1 mishandle iterators, which allows remote attackers to cause a denial of service (heap-based buffer over-read in the WPXTableList class in WPXTable.cpp). This vulnerability can be triggered in LibreOffice before 5.3.7. It may lead to suffering a remote attack against a LibreOffice application.","status":"published","published":"2022-05-13T01:13:44Z","modified":"2025-04-20T03:45:40Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:01:52.186588Z"}],"nvd":[{"id":"CVE-2017-14226","description":"WP1StylesListener.cpp, WP5StylesListener.cpp, and WP42StylesListener.cpp in libwpd 0.10.1 mishandle iterators, which allows remote attackers to cause a denial of service (heap-based buffer over-read in the WPXTableList class in WPXTable.cpp). This vulnerability can be triggered in LibreOffice before 5.3.7. It may lead to suffering a remote attack against a LibreOffice application.","status":"published","published":"2017-09-09T08:29:00.24Z","modified":"2026-06-17T01:05:47.19Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:03:58.85945Z"}],"osv":[{"id":"CVE-2017-14226","description":"WP1StylesListener.cpp, WP5StylesListener.cpp, and WP42StylesListener.cpp in libwpd 0.10.1 mishandle iterators, which allows remote attackers to cause a denial of service (heap-based buffer over-read in the WPXTableList class in WPXTable.cpp). This vulnerability can be triggered in LibreOffice before 5.3.7. It may lead to suffering a remote attack against a LibreOffice application.","status":"published","published":"2017-09-09T08:29:00.24Z","modified":"2026-10-24T10:30:34.002308592Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:04.572713Z"},{"id":"DEBIAN-CVE-2017-14226","description":"WP1StylesListener.cpp, WP5StylesListener.cpp, and WP42StylesListener.cpp in libwpd 0.10.1 mishandle iterators, which allows remote attackers to cause a denial of service (heap-based buffer over-read in the WPXTableList class in WPXTable.cpp). This vulnerability can be triggered in LibreOffice before 5.3.7. It may lead to suffering a remote attack against a LibreOffice application.","status":"published","published":"2017-09-09T08:29:00.24Z","modified":"2026-09-01T20:03:43.75351713Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:28.801885Z"},{"id":"UBUNTU-CVE-2017-14226","description":"WP1StylesListener.cpp, WP5StylesListener.cpp, and WP42StylesListener.cpp in libwpd 0.10.1 mishandle iterators, which allows remote attackers to cause a denial of service (heap-based buffer over-read in the WPXTableList class in WPXTable.cpp). This vulnerability can be triggered in LibreOffice before 5.3.7. It may lead to suffering a remote attack against a LibreOffice application.","status":"published","published":"2017-09-09T08:29:00Z","modified":"2026-04-22T11:16:13.808525Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:14.122973Z"},{"id":"MGASA-2017-0358","title":"Updated libwpd packages fix security vulnerability","description":"WP1StylesListener.cpp, WP5StylesListener.cpp, and WP42StylesListener.cpp\nin libwpd 0.10.1 mishandle iterators, which allows remote attackers to\ncause a denial of service (heap-based buffer over-read in the\nWPXTableList class in WPXTable.cpp). This vulnerability can be triggered\nin LibreOffice before 5.3.7. It may lead to suffering a remote attack\nagainst a LibreOffice application. (CVE-2017-14226)\n","status":"published","published":"2017-10-05T20:08:40Z","modified":"2026-04-16T06:24:32.310351261Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"openSUSE-SU-2024:11013-1","title":"libwpd-0_10-10-0.10.3-2.3 on GA media","description":"These are all security issues fixed in the libwpd-0_10-10-0.10.3-2.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:15:15.274227Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2017:2931-1","title":"Security update for libwpd","description":"This update for libwpd fixes the following issues:\n\nSecurity issue fixed:\n- CVE-2017-14226: WP1StylesListener.cpp, WP5StylesListener.cpp, and WP42StylesListener.cpp in libwpd\n  0.10.1 mishandle iterators, which allows remote attackers to cause a denial of service (heap-based\n  buffer over-read in the WPXTableList class in WPXTable.cpp). This vulnerability can be triggered\n  in LibreOffice before 5.3.7. It may lead to suffering a remote attack against a LibreOffice\n  application. (bnc#1058025)\n\nBugfixes:\n- Fix various crashes, leaks and hangs when reading damaged files found by oss-fuzz.\n- Fix crash when NULL is passed as input stream.\n- Use symbol visibility on Linux. The library only exports public functions now.\n- Avoid infinite loop. (libwpd#3)\n- Remove bashism. (libwpd#5)\n- Fix various crashes and hangs when reading broken files found with the help of american-fuzzy-lop.\n- Make --help output of all command line tools more help2man-friendly.\n- Miscellaneous fixes and cleanups.\n- Generate manpages for the libwpd-tools\n","status":"published","published":"2017-11-06T08:42:15Z","modified":"2025-05-02T04:06:25.102545Z","updated_at":"2026-11-02T15:53:44.209561Z"}]}}