Bug 1351197 (CVE-2016-4324)

Summary: CVE-2016-4324 libreoffice: Dereference of invalid STL iterator on processing RTF file
Product: [Other] Security Response Reporter: Adam Mariš <amaris>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: caolanm, dtardon, erack, mstahl, sbergman
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Fixed In Version: libreoffice 5.1.4, libreoffice 5.2.0 Doc Type: If docs needed, set a value
Doc Text:
A use-after-free vulnerability was found in the Rich Text Format (RTF) document format parser in LibreOffice. By tricking a user into opening a specially crafted RTF document, an attacker could possibly use this flaw to execute arbitrary code with the privileges of the user opening the file.
Story Points: ---
Clone Of: Environment:
Last Closed: 2016-07-08 08:42:47 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1351199, 1353839    
Bug Blocks: 1351198    

Description Adam Mariš 2016-06-29 12:45:58 UTC
A use after free vulnerability was found in RTF parser of LibreOffice. The vulnerability lies in the parsing of documents containing both stylesheet and superscript tokens. A specially crafted RTF document containing both a stylesheet and superscript element causes LibreOffice to access an invalid pointer referencing previously used memory on the heap. By carefully manipulating the contents of the heap, this vulnerability can be used to execute arbitrary code.

External References:


Comment 1 Adam Mariš 2016-06-29 12:48:48 UTC
Created libreoffice tracking bugs for this issue:

Affects: fedora-23 [bug 1351199]

Comment 2 Fedora Update System 2016-07-05 08:24:11 UTC
libreoffice- has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.