CVE-2019-16338

The tfocommon component in HwordApp.dll in Hancom Office 9.6.1.7634 allows a use-after-free via a crafted .docx file...

Design/Logic Flaw

The hncbd90 component in Hancom Office 9.6.1.9403 allows a use-after-free via an unknown object in a crafted .docx file...

Design/Logic Flaw

The tfocommon component in HwordApp.dll in Hancom Office 9.6.1.7634 allows a use-after-free via a crafted .docx file...

CVE-2019-16338

The tfocommon component in HwordApp.dll in Hancom Office 9.6.1.7634 allows a use-after-free via a crafted .docx file...

CVE-2019-16338

The CVE-2019-16338 issue affects Hancom Office’s HwordApp.dll (tfo_common) in version 9.6.1.7634, where a crafted .docx enables a use-after-free vulnerability. Public sources in the connected docs describe the flaw and corroborate that it can lead to arbitrary code execution. CVSS data indicates ...

CVE-2019-16337

CVE-2019-16337 affects Hancom Office 9.6.1.9403 via the hncbd90 library. A use-after-free is triggered by an unknown object in a crafted .docx file, allowing arbitrary code execution in the application's context (per CNVD entry mentioning code execution). Other connected records reiterate the sam...

SUSE SLED15 / SLES15 Security Update : LibreOffice (SUSE-SU-2020:0121-1)

This update libreoffice to version 6.3.3 fixes the following issues : LibreOffice was updated to 6.3.3 jscSLE-8705, bringing many bug and stability fixes. More information for the 6.3 release at: https://wiki.documentfoundation.org/ReleaseNotes/6.3 Security issue fixed : CVE-2019-9853: Fixed an...

CVE-2019-13358

lib/DocumentToText.php in OpenCats before 0.9.4-3 has XXE that allows remote users to read files on the underlying operating system. The attacker must upload a file in the docx or odt format...

Format string

lib/DocumentToText.php in OpenCats before 0.9.4-3 has XXE that allows remote users to read files on the underlying operating system. The attacker must upload a file in the docx or odt format...

CVE-2019-13358

lib/DocumentToText.php in OpenCats before 0.9.4-3 has XXE that allows remote users to read files on the underlying operating system. The attacker must upload a file in the docx or odt format...

CVE-2019-13358

OpenCats prior to 0.9.4-3 contains an XXE in lib/DocumentToText.php that lets remote attackers read files on the underlying OS. Exploitation requires the attacker to upload a docx or odt document, triggering the entity processing. The issue is associated with OpenCats 0.9.4-3 and earlier, with fi...

Microsoft Word DOCX Parsing Use-After-Free Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Microsoft Word. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsi...

Old dog, new tricks - Analysing new RTF-based campaign distributing Agent Tesla, Loki with PyREbox

This blog post was authored by Edmund Brumaghin and Holger Unterbrink with contributions from Emmanuel Tacheau. Executive Summary Cisco Talos has discovered a new malware campaign that drops the sophisticated information-stealing trojan called "Agent Tesla," and other malware such as the Loki...

Security Bulletin: Two vulnerabilities exist in IBM FileNet Content Manager and IBM Content Foundation (CVE-2015-0474 and CVE-2015-0493)

Summary Oracle Outside In Technology vulnerabilities were disclosed on April 14, 2015 by Oracle. These vulnerabilities are documented in CVE-2015-0474 and CVE-2015-0493 and affect the IBM FileNet Content Manager and IBM Content Foundation products. Vulnerability Details CVEID: CVE-2015-0474...

Security update for libreoffice (moderate)

This update for libreoffice to 6.0.4.2 fixes lots of bugs and also the following issues: Security issues fixed: - CVE-2018-10120: The SwCTBWrapper::Read function in sw/source/filter/ww8/ww8toolbar.cxx did not validate a customizations index, which allowed remote attackers to cause a denial of...

openSUSE Security Update : libreoffice (openSUSE-2018-467)

This update for libreoffice to 6.0.4.2 fixes lots of bugs and also the following issues : Security issues fixed : - CVE-2018-10120: The SwCTBWrapper::Read function in sw/source/filter/ww8/ww8toolbar.cxx did not validate a customizations index, which allowed remote attackers to cause a denial of...

Hyland Perceptive Document Filters DOCX to HTML Code Execution Vulnerability(CVE-2018-3844)

Summary An exploitable use after free exists in the DOCX to HTML conversion functionality of the Hyland Perspective Document Filters version 11.4.0.2647. A crafted DOCX document can lead to a use-after-free resulting in direct code execution. Tested Versions Perceptive Document Filters 11.4.0.264...

SUSE SLED12 Security Update : libreoffice (SUSE-SU-2018:1296-1)

This update for libreoffice to 6.0.4.2 fixes lots of bugs and also the following issues: Security issues fixed : - CVE-2018-10120: The SwCTBWrapper::Read function in sw/source/filter/ww8/ww8toolbar.cxx did not validate a customizations index, which allowed remote attackers to cause a denial of...

SUSE-SU-2018:1296-1 Security update for libreoffice

This update for libreoffice to 6.0.4.2 fixes lots of bugs and also the following issues: Security issues fixed: - CVE-2018-10120: The SwCTBWrapper::Read function in sw/source/filter/ww8/ww8toolbar.cxx did not validate a customizations index, which allowed remote attackers to cause a denial of...

LibreOffice 6.0.3 / OpenOffice 4.1.5 Information Disclosure

! /usr/bin/python Exploit Title: Malicious ODF File Creator Date: 1st May 2018 Exploit Author: Richard Davy Vendor Homepage: https://www.libreoffice.org/ Software Link: https://www.libreoffice.org/ Version: LibreOffice 6.0.3, OpenOffice 4.1.5 Tested on: Windows 10 Quick script/POC code to create ...