CVE-2016-6804

Опубликовано: 20 нояб. 2017

Источник: nvd

CVSS3: 7.8

CVSS2: 9.3

EPSS Низкий

Описание

The Apache OpenOffice installer (versions prior to 4.1.3, including some branded as OpenOffice.org) for Windows contains a defective operation that allows execution of arbitrary code with elevated privileges. This requires that the location in which the installer is run has been previously poisoned by a file that impersonates a dynamic-link library that the installer depends upon.

Ссылки

http://www.securityfocus.com/bid/93774
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1037016
Third Party Advisory
VDB Entry
https://www.openoffice.org/security/cves/CVE-2016-6804.html
Vendor Advisory
http://www.securityfocus.com/bid/93774
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1037016
Third Party Advisory
VDB Entry
https://www.openoffice.org/security/cves/CVE-2016-6804.html
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:a:apache:openoffice:*:*:*:*:*:*:*:*

Версия до 4.1.3 (исключая)

cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

EPSS

Процентиль: 51%

0.00276

Низкий

7.8 High

CVSS3

9.3 Critical

CVSS2

Дефекты

CWE-264

Связанные уязвимости

GHSA-px53-377g-jhqr