LibreOffice vulnerabilities

Use-after-free vulnerability in LibreOffice before 5.1.4 allows remote attackers to execute arbitrary code via a crafted RTF file, related to stylesheet and superscript tokens.

LibreOffice versions before 5.0.5 allow remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted LwpTocSuperLayout record in a LotusWordPro (lwp) document.

LibreOffice versions before 4.3.5 allow remote attackers to cause a denial of service (invalid write operation and crash) and possibly execute arbitrary code via a crafted RTF file.

LibreOffice version 4.2.4 automatically executes unspecified VBA macros, which may lead to unknown impacts and attack vectors.

LibreOffice before 2017-03-17 has an out-of-bounds write caused by a heap-based buffer overflow related to the ReadJPEG function in vcl/source/filter/jpeg/jpegc.cxx.

LibreOffice before March 14, 2017, has an out-of-bounds write related to the HWPFile::TagsRead function in hwpfilter/source/hwpfile.cxx.

LibreOffice before 2017-01-02 has an out-of-bounds write caused by a heap-based buffer overflow related to the tools::Polygon::Insert function in tools/source/generic/poly.cxx.

LibreOffice before 2017-03-11 has an out-of-bounds write caused by a heap-based buffer overflow in the SVMConverter::ImplConvertFromSVM1 function.

LibreOffice before December 22, 2016, has an out-of-bounds write caused by a heap-based buffer overflow related to the EnhWMFReader::ReadEnhWMF function in vcl/source/filter/wmf/enhwmf.cxx.

LibreOffice has a stack buffer overflow when importing presentations in the legacy PPT format. This occurs during the import of a colour-replacement record when the combined colour counts exceed the size of the colour tables.

LibreOffice has a heap buffer overflow vulnerability when replaying deferred parser events for a text box element in OOXML (DOCX) documents. The issue arises from assuming a handler object is of one type, leading to writes beyond the end of the allocation.

LibreOffice has a heap buffer overflow vulnerability when importing EMF+ graphics, which can lead to memory corruption. The issue arises from incorrectly calculating the allocation size for a gradient, potentially resulting in improper memory allocation.

LibreOffice had a heap buffer overflow vulnerability when importing DXF polylines. The point count from the file was truncated to a 16-bit value, leading to writing past the end of the buffer when the point count exceeded this range.