CVE-2016-4324

LibreOffice versions before 5.0.5 allow remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted LwpTocSuperLayout record in a LotusWordPro (lwp) document.

LibreOffice versions before 4.3.5 allow remote attackers to cause a denial of service (invalid write operation and crash) and possibly execute arbitrary code via a crafted RTF file.

LibreOffice version 4.2.4 automatically executes unspecified VBA macros, which may lead to unknown impacts and attack vectors.

LibreOffice before 2017-03-17 has an out-of-bounds write caused by a heap-based buffer overflow related to the ReadJPEG function in vcl/source/filter/jpeg/jpegc.cxx.

LibreOffice before March 14, 2017, has an out-of-bounds write related to the HWPFile::TagsRead function in hwpfilter/source/hwpfile.cxx.

LibreOffice before 2017-01-02 has an out-of-bounds write caused by a heap-based buffer overflow related to the tools::Polygon::Insert function in tools/source/generic/poly.cxx.

LibreOffice before 2017-03-11 has an out-of-bounds write caused by a heap-based buffer overflow in the SVMConverter::ImplConvertFromSVM1 function.

LibreOffice before December 22, 2016, has an out-of-bounds write caused by a heap-based buffer overflow related to the EnhWMFReader::ReadEnhWMF function in vcl/source/filter/wmf/enhwmf.cxx.

LibreOffice has a stack buffer overflow when importing presentations in the legacy PPT format. This occurs during the import of a colour-replacement record when the combined colour counts exceed the size of the colour tables.

LibreOffice has a heap buffer overflow vulnerability when replaying deferred parser events for a text box element in OOXML (DOCX) documents. The issue arises from assuming a handler object is of one type, leading to writes beyond the end of the allocation.