CVE-2018-10583

An information disclosure vulnerability occurs when LibreOffice 6.0.3 and Apache OpenOffice Writer 4.1.5 automatically process and initiate an SMB connection embedded in a malicious file, as demonstrated by xlink:href=file://192.168.0.2/test.jpg within an office:document-content element in a .odt XML document.

• CWE-200

• http://seclists.org/fulldisclosure/2020/Oct/26
• http://secureyourit.co.uk/wp/2018/05/01/creating-malicious-odt-files/Exploit, Mitigation, Third Party Advisory
• https://access.redhat.com/errata/RHSA-2018:3054Third Party Advisory
• https://lists.apache.org/thread.html/0598708912978b27121b2e380b44a225c706aca882cd1da6a955a0af%40%3Cdev.openoffice.apache.org%3E
• https://lists.apache.org/thread.html/6c65f22306c36c95e75f8d2b7f49cfcbeb0a4614245c20934612a39d%40%3Cdev.openoffice.apache.org%3E
• https://lists.apache.org/thread.html/c8fd59ac77b42aac90eb5c59b87f3ab59b5e0c3bfb4819aa649a2909%40%3Cdev.openoffice.apache.org%3E
• https://security-tracker.debian.org/tracker/CVE-2018-10583Issue Tracking, Third Party Advisory
• https://usn.ubuntu.com/3883-1/Third Party Advisory
• https://www.exploit-db.com/exploits/44564/Exploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2020/Oct/26
• http://secureyourit.co.uk/wp/2018/05/01/creating-malicious-odt-files/Exploit, Mitigation, Third Party Advisory
• https://access.redhat.com/errata/RHSA-2018:3054Third Party Advisory
• https://lists.apache.org/thread.html/0598708912978b27121b2e380b44a225c706aca882cd1da6a955a0af%40%3Cdev.openoffice.apache.org%3E
• https://lists.apache.org/thread.html/6c65f22306c36c95e75f8d2b7f49cfcbeb0a4614245c20934612a39d%40%3Cdev.openoffice.apache.org%3E
• https://lists.apache.org/thread.html/c8fd59ac77b42aac90eb5c59b87f3ab59b5e0c3bfb4819aa649a2909%40%3Cdev.openoffice.apache.org%3E
• https://security-tracker.debian.org/tracker/CVE-2018-10583Issue Tracking, Third Party Advisory
• https://usn.ubuntu.com/3883-1/Third Party Advisory
• https://www.exploit-db.com/exploits/44564/Exploit, Third Party Advisory, VDB Entry

Published

May 1, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-10576An issue was discovered on WatchGuard AP100, AP102, and AP20…
• CVE-2018-10577An issue was discovered on WatchGuard AP100, AP102, and AP20…
• CVE-2018-10578An issue was discovered on WatchGuard AP100, AP102, and AP20…
• CVE-2018-1058A flaw was found in the way Postgresql allowed a user to mod…8.8
• CVE-2018-10580The "Latest Posts on Profile" plugin 1.1 for MyBB has XSS be…
• CVE-2018-10581In Octopus Deploy 3.4.x before 2018.4.7, an authenticated us…
• CVE-2018-10585Pexip Infinity before 18 allows remote Denial of Service (XM…7.5
• CVE-2018-10586NetGain Enterprise Manager (EM) is affected by multiple Stor…
• CVE-2018-10587NetGain Enterprise Manager (EM) is affected by OS Command In…
• CVE-2018-10589In Advantech WebAccess versions V8.2_20170817 and prior, Web…
• CVE-2018-1059The DPDK vhost-user interface does not check to verify that …
• CVE-2018-10590In Advantech WebAccess versions V8.2_20170817 and prior, Web…