CVE-2016-4324 — Improper Input Validation in Libreoffice

CWE-20 — Improper Input ValidationCWE-416 — Use After Free10 documents8 sources
Severity
7.8HIGHNVD
EPSS
0.7%
top 28.71%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
LibreofficeDebian LibreofficeCanonical Ubuntu Linux+1 more
Timeline
PublishedJul 8
Latest updateMay 17

Description

Use-after-free vulnerability in LibreOffice before 5.1.4 allows remote attackers to execute arbitrary code via a crafted RTF file, related to stylesheet and superscript tokens.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages3 packages

▶debiandebian/libreoffice< libreoffice 1:5.1.4~rc1-1 (bookworm)
▶Debianlibreoffice/libreoffice< 1:5.1.4~rc1-1+3

Also affects: Debian Linux 8.0, Ubuntu Linux 12.04, 15.10, 16.04

🔴Vulnerability Details

2
GHSA
GHSA-fhmw-mf54-383v: Use-after-free vulnerability in LibreOffice before 5↗2022-05-17
▶
OSV
CVE-2016-4324: Use-after-free vulnerability in LibreOffice before 5↗2016-07-08
▶

📋Vendor Advisories

3
Ubuntu
LibreOffice vulnerability↗2016-06-29
▶
Red Hat
libreoffice: Dereference of invalid STL iterator on processing RTF file↗2016-06-28
▶
Debian
CVE-2016-4324: libreoffice - Use-after-free vulnerability in LibreOffice before 5.1.4 allows remote attackers...↗2016
▶

🕵️Threat Intelligence

2
Talos
Vulnerability Spotlight: LibreOffice RTF Vulnerability↗2016-06-28
▶
Talos
Vulnerability Spotlight: LibreOffice RTF Vulnerability↗2016-06-28
▶

💬Community

2
Bugzilla
CVE-2016-4324 libreoffice: Dereference of invalid STL iterator on processing RTF file [fedora-23]↗2016-06-29
▶
Bugzilla
CVE-2016-4324 libreoffice: Dereference of invalid STL iterator on processing RTF file↗2016-06-29
▶