CVE-2017-9806
Last modified
CVE-2017-9806 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. A vulnerability in the OpenOffice Writer DOC file parser before 4.1.4, and specifically in the WW8Fonts Constructor, allows attackers to craft malicious documents that cause denial of service (memory corruption and application crash) potentially resulting in arbitrary code execution.. EPSS estimates a 1.80% chance of exploitation in the next 30 days.
Description
A vulnerability in the OpenOffice Writer DOC file parser before 4.1.4, and specifically in the WW8Fonts Constructor, allows attackers to craft malicious documents that cause denial of service (memory corruption and application crash) potentially resulting in arbitrary code execution.
Metrics
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Apache | Openoffice | < 4.1.4 |
References
- http://www.openoffice.org/security/cves/CVE-2017-9806.htmlVendor Advisory
- http://www.securityfocus.com/bid/101585Broken Link, Third Party Advisory, VDB Entry
- http://www.openoffice.org/security/cves/CVE-2017-9806.htmlVendor Advisory
- http://www.securityfocus.com/bid/101585Broken Link, Third Party Advisory, VDB Entry
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2017-9806?
How severe is CVE-2017-9806?
How do I fix CVE-2017-9806?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2017
- CVE-2017-9800A maliciously constructed svn+ssh:// URL would cause Subvers…
- CVE-2017-9801When a call-site passes a subject for an email that contains…
- CVE-2017-9802The Javascript method Sling.evalString() in Apache Sling Ser…
- CVE-2017-9803Apache Solr's Kerberos plugin can be configured to use deleg…
- CVE-2017-9804In Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12…
- CVE-2017-9805The REST Plugin in Apache Struts 2.1.1 through 2.3.x before …8.1
- CVE-2017-9807An issue was discovered in the OpenWebif plugin through 1.2.…
- CVE-2017-9808OX Software GmbH OX App Suite 7.8.4 and earlier is affected …
- CVE-2017-9809OX Software GmbH OX App Suite 7.8.4 and earlier is affected …
- CVE-2017-9810There are no Anti-CSRF tokens in any forms on the web interf…
- CVE-2017-9811The kluser is able to interact with the kav4fs-control binar…
- CVE-2017-9812The reportId parameter of the getReportStatus action method …
Are you affected by CVE-2017-9806?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST