Bug 1351197 (CVE-2016-4324) - CVE-2016-4324 libreoffice: Dereference of invalid STL iterator on processing RTF file
Summary: CVE-2016-4324 libreoffice: Dereference of invalid STL iterator on processing ...
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2016-4324
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1351199 1353839
Blocks: 1351198
TreeView+ depends on / blocked
 
Reported: 2016-06-29 12:45 UTC by Adam Mariš
Modified: 2021-02-17 03:38 UTC (History)
5 users (show)

Fixed In Version: libreoffice 5.1.4, libreoffice 5.2.0
Doc Type: If docs needed, set a value
Doc Text:
A use-after-free vulnerability was found in the Rich Text Format (RTF) document format parser in LibreOffice. By tricking a user into opening a specially crafted RTF document, an attacker could possibly use this flaw to execute arbitrary code with the privileges of the user opening the file.
Clone Of:
Environment:
Last Closed: 2016-07-08 08:42:47 UTC
Embargoed:

Attachments (Terms of Use)

Description Adam Mariš 2016-06-29 12:45:58 UTC 
A use after free vulnerability was found in RTF parser of LibreOffice. The vulnerability lies in the parsing of documents containing both stylesheet and superscript tokens. A specially crafted RTF document containing both a stylesheet and superscript element causes LibreOffice to access an invalid pointer referencing previously used memory on the heap. By carefully manipulating the contents of the heap, this vulnerability can be used to execute arbitrary code.

External References:

https://www.libreoffice.org/about-us/security/advisories/cve-2016-4324/
http://blog.talosintel.com/2016/06/vulnerability-spotlight-libreoffice-rtf.html
Comment 1 Adam Mariš 2016-06-29 12:48:48 UTC 
Created libreoffice tracking bugs for this issue:

Affects: fedora-23 [bug 1351199]
Comment 2 Fedora Update System 2016-07-05 08:24:11 UTC 
libreoffice-5.0.6.2-9.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.
Comment 3 Huzaifa S. Sidhpurwala 2016-07-08 05:50:02 UTC 
Upstream patch:

https://cgit.freedesktop.org/libreoffice/core/commit/?id=05cc87ce45fad402445c8d748817e386e56148af
Note You need to log in before you can comment on or make changes to this bug.