CVE-2016-6803

7.8HIGH

Key Information:

Vendor
Apache
Status
Apache Openoffice
Vendor
CVE Published:
13 November 2017

Summary

An installer defect known as an "unquoted Windows search path vulnerability" affected the Apache OpenOffice before 4.1.3 installers for Windows. The PC must have previously been infected by a Trojan Horse application (or user) running with administrative privilege. Any installer with the unquoted search path vulnerability becomes a delayed trigger for the exploit.

Affected Version(s)

Apache OpenOffice 4.0.0 to 4.1.2

Apache OpenOffice Older versions, including some using the previous OpenOffice.org brand, are also affected.

References

http://www.securityfocus.com/bid/94418
vdb-entryx_refsource_BID
https://www.openoffice.org/security/cves/CVE-2016-6803.html
x_refsource_CONFIRM
http://www.securitytracker.com/id/1037015
vdb-entryx_refsource_SECTRACK

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.