Bug 587566 – <app-office/libreoffice{-bin}-5.1.4.2: Dereference of invalid STL iterator on processing RTF file

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Agostino Sarubbo 2016-06-30 09:02:29 UTC]

From ${URL} :

A use after free vulnerability was found in RTF parser of LibreOffice. The vulnerability lies in the parsing of documents containing both stylesheet and 
superscript tokens. A specially crafted RTF document containing both a stylesheet and superscript element causes LibreOffice to access an invalid pointer 
referencing previously used memory on the heap. By carefully manipulating the contents of the heap, this vulnerability can be used to execute arbitrary 
code.

External References:

https://www.libreoffice.org/about-us/security/advisories/cve-2016-4324/
http://blog.talosintel.com/2016/06/vulnerability-spotlight-libreoffice-rtf.html


@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.

[Comment 1 Andreas Sturmlechner 2016-06-30 09:49:51 UTC]

5.1.4.2 version bump pending: https://github.com/gentoo/gentoo/pull/1663

[Comment 2 Andreas K. Hüttel 2016-07-02 21:17:45 UTC]

Ebuild added. Let's keep it in ~arch for a bit to see some testing.

[Comment 3 Andreas K. Hüttel 2016-07-20 22:20:22 UTC]

Please stabilize LibreOffice 5.1.4.2 and friends. 
See bug 589284 for the details.

[Comment 4 Agostino Sarubbo 2016-07-28 14:44:39 UTC]

stabilization done.

[Comment 5 Andreas K. Hüttel 2016-07-28 15:25:28 UTC]

cleanup done, office out

[Comment 6 Yury German 2016-09-10 07:32:31 UTC]

New GLSA Request filed.

[Comment 7 GLSAMaker/CVETool Bot 2016-11-04 07:57:38 UTC]

This issue was resolved and addressed in
 GLSA 201611-03 at https://security.gentoo.org/glsa/201611-03
by GLSA coordinator Aaron Bauman (b-man).