Connect with us

Hi, what are you looking for?



Third-Party Patch Released for Code Execution Flaw in OpenOffice

An unofficial patch has been made available for a recently disclosed remote code execution vulnerability affecting the Apache OpenOffice open source productivity suite.

An unofficial patch has been made available for a recently disclosed remote code execution vulnerability affecting the Apache OpenOffice open source productivity suite.

The flaw, described as a path traversal issue and tracked as CVE-2018-16858, was disclosed in early February by researcher Alex Inführ. The expert found that a hacker could execute code on a system by getting the targeted user to open a specially crafted document that loaded a Python file placed by the attacker anywhere on the device.

The attack involves a document containing a specially crafted link pointing to a Python script. When the victim opens the document and hovers over the link, the malicious code gets executed without any warning message being displayed. In order to avoid raising suspicion and make the attack more likely to succeed, a hacker can create a document where the entire page is filled with links whose color has been set to white – this way the victim only sees a blank page before the exploit is executed.

Inführ says the vulnerability impacts both LibreOffice and OpenOffice. However, LibreOffice developers released a patch less than two weeks after being notified.

OpenOffice developers, however, do not appear to have issued any fixes and have not made any comments on the vulnerability. SecurityWeek has reached out to them more than one week ago, but received no response.

ACROS Security’s 0patch service has released an unofficial patch for OpenOffice to address this vulnerability. The micropatch can be applied to the latest version of OpenOffice for Windows. Micropatches have been released for LibreOffice as well.

0patch releases fix for OpenOffice vulnerability

0patch has published a video showing an exploit attempt without and with the patch applied:

Advertisement. Scroll to continue reading.

0patch this week also released a fix for an Adobe Reader vulnerability that had been unpatched. Adobe released an official patch the next day.

Related: Unofficial Patches Released for Three Unfixed Windows Flaws

Related: Third-Party Patch Released for Windows Zero-Day

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join security experts as they discuss ZTNA’s untapped potential to both reduce cyber risk and empower the business.


Join Microsoft and Finite State for a webinar that will introduce a new strategy for securing the software supply chain.


Expert Insights

Related Content


Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...

IoT Security

A group of seven security researchers have discovered numerous vulnerabilities in vehicles from 16 car makers, including bugs that allowed them to control car...


The latest Chrome update brings patches for eight vulnerabilities, including seven reported by external researchers.


Patch Tuesday: Microsoft warns vulnerability (CVE-2023-23397) could lead to exploitation before an email is viewed in the Preview Pane.


A researcher at IOActive discovered that home security systems from SimpliSafe are plagued by a vulnerability that allows tech savvy burglars to remotely disable...


Patch Tuesday: Microsoft calls attention to a series of zero-day remote code execution attacks hitting its Office productivity suite.