Skip to content
Fencer Vulns
medium 5.5

CVE-2017-3157 json

By exploiting the way Apache OpenOffice before 4.1.4 renders embedded objects, an attacker could craft a document that allows reading in a…

published 2017-11-20 8 y ago modified 2026-06-17 4 mo ago also EUVD-2017-12291

cvss
5.5
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
3.1%
EPSS 3.1% chance of exploitation in 30 days, percentile 87%
public exploits
0
none known

Summary

By exploiting the way Apache OpenOffice before 4.1.4 renders embedded objects, an attacker could craft a document that allows reading in a file from the user's filesystem. Information could be retrieved by the attacker by, e.g., using hidden sections to store the information, tricking the user into saving the document and convincing the user to send the document back to the attacker. The vulnerability is mitigated by the need for the attacker to know the precise file path in the target system, and the need to trick the user into saving the document and sending it back.

Patch / fix

  • libreoffice Debian 14, Debian 13, Debian 12 1:5.2.3-1

debian advisories DEBIAN-CVE-2017-3157

  • libreoffice Ubuntu 14.04 LTS 1:4.2.8-0ubuntu5
  • libreoffice Ubuntu 16.04 LTS 1:5.1.6~rc2-0ubuntu1~xenial1

ubuntu advisories UBUNTU-CVE-2017-3157

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • libreoffice RHEL 6 1:4.3.7.2-2.el6_9.1
  • autocorr-af RHEL 6 1:4.3.7.2-2.el6_9.1
  • autocorr-bg RHEL 6 1:4.3.7.2-2.el6_9.1
  • autocorr-ca RHEL 6 1:4.3.7.2-2.el6_9.1
  • autocorr-cs RHEL 6 1:4.3.7.2-2.el6_9.1
  • autocorr-da RHEL 6 1:4.3.7.2-2.el6_9.1
  • autocorr-de RHEL 6 1:4.3.7.2-2.el6_9.1
  • autocorr-en RHEL 6 1:4.3.7.2-2.el6_9.1

red hat advisories RHSA-2017:0979RHSA-2017:0914

  • libreoffice openSUSE Tumbleweed 7.1.5.2-3.13

opensuse advisories openSUSE-SU-2024:10983-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2017-3157 updated cvss 4.7

libreoffice: Arbitrary file disclosure in Calc and Writer

  • Red Hat Enterprise Linux Client (v. 7) autocorr-af 5.0.6.2-5.el7_3.1, autocorr-bg 5.0.6.2-5.el7_3.1, autocorr-ca 5.0.6.2-5.el7_3.1, autocorr-cs 5.0.6.2-5.el7_3.1, autocorr-da 5.0.6.2-5.el7_3.1, autocorr-de 5.0.6.2-5.el7_3.1, +54 more Red Hat Enterprise Linux Client Optional (v. 7) autocorr-af 5.0.6.2-5.el7_3.1, autocorr-bg 5.0.6.2-5.el7_3.1, autocorr-ca 5.0.6.2-5.el7_3.1, autocorr-cs 5.0.6.2-5.el7_3.1, autocorr-da 5.0.6.2-5.el7_3.1, autocorr-de 5.0.6.2-5.el7_3.1, +54 more
    fixed: vendor fix RHSA-2017:0914
  • Red Hat Enterprise Linux Desktop (v. 6) autocorr-af 4.3.7.2-2.el6_9.1, autocorr-bg 4.3.7.2-2.el6_9.1, autocorr-ca 4.3.7.2-2.el6_9.1, autocorr-cs 4.3.7.2-2.el6_9.1, autocorr-da 4.3.7.2-2.el6_9.1, autocorr-de 4.3.7.2-2.el6_9.1, +54 more Red Hat Enterprise Linux Desktop Optional (v. 6) autocorr-af 4.3.7.2-2.el6_9.1, autocorr-bg 4.3.7.2-2.el6_9.1, autocorr-ca 4.3.7.2-2.el6_9.1, autocorr-cs 4.3.7.2-2.el6_9.1, autocorr-da 4.3.7.2-2.el6_9.1, autocorr-de 4.3.7.2-2.el6_9.1, +54 more Red Hat Enterprise Linux Server Optional (v. 6) autocorr-af 4.3.7.2-2.el6_9.1, autocorr-bg 4.3.7.2-2.el6_9.1, autocorr-ca 4.3.7.2-2.el6_9.1, autocorr-cs 4.3.7.2-2.el6_9.1, autocorr-da 4.3.7.2-2.el6_9.1, autocorr-de 4.3.7.2-2.el6_9.1, +54 more
    fixed: vendor fix RHSA-2017:0979
  • Red Hat Enterprise Linux Server Optional (v. 7) autocorr-af 5.0.6.2-5.el7_3.1, autocorr-bg 5.0.6.2-5.el7_3.1, autocorr-ca 5.0.6.2-5.el7_3.1, autocorr-cs 5.0.6.2-5.el7_3.1, autocorr-da 5.0.6.2-5.el7_3.1, autocorr-de 5.0.6.2-5.el7_3.1, +54 more
    fixed: vendor fix RHSA-2017:0914
  • Red Hat Enterprise Linux Workstation (v. 6) autocorr-af 4.3.7.2-2.el6_9.1, autocorr-bg 4.3.7.2-2.el6_9.1, autocorr-ca 4.3.7.2-2.el6_9.1, autocorr-cs 4.3.7.2-2.el6_9.1, autocorr-da 4.3.7.2-2.el6_9.1, autocorr-de 4.3.7.2-2.el6_9.1, +54 more
    fixed: vendor fix RHSA-2017:0979
  • Red Hat Enterprise Linux Workstation (v. 7) autocorr-af 5.0.6.2-5.el7_3.1, autocorr-bg 5.0.6.2-5.el7_3.1, autocorr-ca 5.0.6.2-5.el7_3.1, autocorr-cs 5.0.6.2-5.el7_3.1, autocorr-da 5.0.6.2-5.el7_3.1, autocorr-de 5.0.6.2-5.el7_3.1, +54 more
    fixed: vendor fix RHSA-2017:0914
  • Red Hat Enterprise Linux Workstation Optional (v. 6) autocorr-af 4.3.7.2-2.el6_9.1, autocorr-bg 4.3.7.2-2.el6_9.1, autocorr-ca 4.3.7.2-2.el6_9.1, autocorr-cs 4.3.7.2-2.el6_9.1, autocorr-da 4.3.7.2-2.el6_9.1, autocorr-de 4.3.7.2-2.el6_9.1, +54 more
    fixed: vendor fix RHSA-2017:0979
  • Red Hat Enterprise Linux Workstation Optional (v. 7) autocorr-af 5.0.6.2-5.el7_3.1, autocorr-bg 5.0.6.2-5.el7_3.1, autocorr-ca 5.0.6.2-5.el7_3.1, autocorr-cs 5.0.6.2-5.el7_3.1, autocorr-da 5.0.6.2-5.el7_3.1, autocorr-de 5.0.6.2-5.el7_3.1, +54 more
    fixed: vendor fix RHSA-2017:0914

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

3.12% chance of exploitation in the next 30 days, higher than 87% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.0 5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N

Affected products

  • Apache Software Foundation Apache OpenOffice

Classification

Weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.