Bug 1351197 (CVE-2016-4324)

Summary:	CVE-2016-4324 libreoffice: Dereference of invalid STL iterator on processing RTF file
Product:	[Other] Security Response	Reporter:	Adam Mariš <amaris>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	caolanm, dtardon, erack, mstahl, sbergman
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	libreoffice 5.1.4, libreoffice 5.2.0	Doc Type:	If docs needed, set a value
Doc Text:	A use-after-free vulnerability was found in the Rich Text Format (RTF) document format parser in LibreOffice. By tricking a user into opening a specially crafted RTF document, an attacker could possibly use this flaw to execute arbitrary code with the privileges of the user opening the file.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-07-08 08:42:47 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1351199, 1353839
Bug Blocks:	1351198

Description Adam Mariš 2016-06-29 12:45:58 UTC

A use after free vulnerability was found in RTF parser of LibreOffice. The vulnerability lies in the parsing of documents containing both stylesheet and superscript tokens. A specially crafted RTF document containing both a stylesheet and superscript element causes LibreOffice to access an invalid pointer referencing previously used memory on the heap. By carefully manipulating the contents of the heap, this vulnerability can be used to execute arbitrary code.

External References:

https://www.libreoffice.org/about-us/security/advisories/cve-2016-4324/
http://blog.talosintel.com/2016/06/vulnerability-spotlight-libreoffice-rtf.html

Comment 1 Adam Mariš 2016-06-29 12:48:48 UTC

Created libreoffice tracking bugs for this issue:

Affects: fedora-23 [bug 1351199]

Comment 2 Fedora Update System 2016-07-05 08:24:11 UTC

libreoffice-5.0.6.2-9.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.

Comment 3 Huzaifa S. Sidhpurwala 2016-07-08 05:50:02 UTC

Upstream patch:

https://cgit.freedesktop.org/libreoffice/core/commit/?id=05cc87ce45fad402445c8d748817e386e56148af