PT-2017-9018 · Apache · Apache Openoffice+1

Published 2017-11-13 · Updated 2017-11-29 · CVE-2016-6803

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache OpenOffice versions prior to 4.1.3

Description The issue is related to an "unquoted Windows search path vulnerability" in the installer for Windows. This vulnerability can be exploited if the system has previously been infected with a Trojan Horse application or if a user is running with administrative privileges. The vulnerability acts as a delayed trigger for the exploit when an installer with the unquoted search path vulnerability is present.

Recommendations For versions prior to 4.1.3, update to version 4.1.3 or later to resolve the issue.

Fix

Untrusted Search Path

Weakness Enumeration

CWE-426

Related Identifiers

CVE-2016-6803

Affected Products

Apache Openoffice

Openoffice

References · 5

• https://osv.dev/vulnerability/CVE-2016-6803 · Vendor Advisory
• https://openoffice.org/security/cves/CVE-2016-6803.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-6803 · Security Note
• http://securitytracker.com/id/1037015 · Note
• http://securityfocus.com/bid/94418 · Note