{"id":"CVE-2016-4324","aliases":["DEBIAN-CVE-2016-4324","DLA-581-1","DSA-3608-1","EUVD-2016-5324","GHSA-fhmw-mf54-383v","MGASA-2016-0246","SUSE-SU-2016:2472-1","UBUNTU-CVE-2016-4324","USN-3022-1","openSUSE-SU-2024:10006-1"],"status":"published","title":"Use-after-free vulnerability in LibreOffice before 5.1.4 allows remote attackers to execute...","description":"Use-after-free vulnerability in LibreOffice before 5.1.4 allows remote attackers to execute arbitrary code via a crafted RTF file, related to stylesheet and superscript tokens.","severity":{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.02819,"percentile":0.86643,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2016-06-29T00:00:00Z","modified":"2026-10-24T10:30:54Z","fixes":[{"ecosystem":"Debian:12","package":"libreoffice","fixed_in":["1:5.1.4~rc1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libreoffice","fixed_in":["1:5.1.4~rc1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libreoffice","fixed_in":["1:5.1.4~rc1-1"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"libreoffice","fixed_in":["1:3.5.4+dfsg2-0+deb7u7"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"libreoffice","fixed_in":["1:4.3.3-2+deb8u5"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"libreoffice","fixed_in":["4.4.7.2-3.mga5"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"librevenge","fixed_in":["0.0.4-1.mga5"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"libcdr","fixed_in":["0.1.2-1.mga5"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"libvisio","fixed_in":["0.1.5-1.mga5"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"libwpd","fixed_in":["0.10.1-1.mga5"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"libreoffice","fixed_in":["5.1.5.2-29.4"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP1","package":"libreoffice","fixed_in":["5.1.5.2-29.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"libreoffice","fixed_in":["1:5.1.4-0ubuntu1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.1.4~rc1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.1.4~rc1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.1.4~rc1-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.4+dfsg2-0+deb7u7"}]}],"versions":["1:3.5.4+dfsg-4","1:3.5.4+dfsg2-0+deb7u1","1:3.5.4+dfsg2-0+deb7u2","1:3.5.4+dfsg2-0+deb7u3","1:3.5.4+dfsg2-0+deb7u4","1:3.5.4+dfsg2-0+deb7u4~bpo60+1","1:3.5.4+dfsg2-0+deb7u5","1:3.5.4+dfsg2-0+deb7u6"]},{"source":"osv","ecosystem":"Debian:8","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.3.3-2+deb8u5"}]}],"versions":["1:4.3.3-2","1:4.3.3-2+deb8u1","1:4.3.3-2+deb8u1~bpo70+1","1:4.3.3-2+deb8u2","1:4.3.3-2+deb8u3","1:4.3.3-2+deb8u3~bpo70+1","1:4.3.3-2+deb8u4"]},{"source":"osv","ecosystem":"Mageia:5","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.7.2-3.mga5"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"librevenge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.4-1.mga5"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"libcdr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.2-1.mga5"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"libvisio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.5-1.mga5"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"libwpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.1-1.mga5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.5.2-29.4"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP1","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.5.2-29.4"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.1.4-0ubuntu1"}]}],"versions":["1:5.0.2-0ubuntu1","1:5.0.2-0ubuntu2","1:5.0.2-0ubuntu5","1:5.0.2-0ubuntu7","1:5.0.2-0ubuntu8","1:5.1.0~rc3-0ubuntu2","1:5.1.0-0ubuntu1","1:5.1.1~rc2-0ubuntu1","1:5.1.1-0ubuntu1","1:5.1.1-0ubuntu3","1:5.1.2-0ubuntu1","1:5.1.3-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.1.4-0ubuntu1"}]}],"versions":["1:5.0.2-0ubuntu1","1:5.0.2-0ubuntu2","1:5.0.2-0ubuntu5","1:5.0.2-0ubuntu7","1:5.0.2-0ubuntu8","1:5.1.0~rc3-0ubuntu2","1:5.1.0-0ubuntu1","1:5.1.1~rc2-0ubuntu1","1:5.1.1-0ubuntu1","1:5.1.1-0ubuntu3","1:5.1.2-0ubuntu1","1:5.1.3-0ubuntu1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libreoffice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.3.3-2.2"}]}],"bundled":17}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"libreoffice","product":"libreoffice"}],"references":[{"url":"http://www.debian.org/security/2016/dsa-3608","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"https://security.gentoo.org/glsa/201611-03","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"http://www.securitytracker.com/id/1036209","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/91499","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://www.libreoffice.org/about-us/security/advisories/cve-2016-4324/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"http://www.ubuntu.com/usn/USN-3022-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"http://www.talosintelligence.com/reports/TALOS-2016-0126/","tags":["x_refsource_MISC","x_transferred","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-4324"},{"url":"http://www.libreoffice.org/about-us/security/advisories/cve-2016-4324"},{"url":"http://www.talosintelligence.com/reports/TALOS-2016-0126"},{"url":"https://github.com/advisories/GHSA-fhmw-mf54-383v"},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-4324","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2016-0246.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=18826","tags":["report"]},{"url":"https://www.libreoffice.org/about-us/security/advisories/cve-2016-4324/","tags":["advisory","report"]},{"url":"https://www.debian.org/security/2016/dsa-3608","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20162472-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1000102","tags":["report"]},{"url":"https://bugzilla.suse.com/987553","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4324","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2016-4324","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3022-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-4324","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2010-2935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-2936","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0247","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3524","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3575","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3693","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8146","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8147","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9093","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4551","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-45513","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5212","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5213","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5214","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0794","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0795","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2016-4324","description":"Use-after-free vulnerability in LibreOffice before 5.1.4 allows remote attackers to execute arbitrary code via a crafted RTF file, related to stylesheet and superscript tokens.","status":"published","published":"2016-07-08T19:00:00Z","modified":"2024-08-06T00:25:14.442Z","updated_at":"2026-11-02T14:33:35.149563Z"}],"euvd":[{"id":"EUVD-2016-5324","description":"Use-after-free vulnerability in LibreOffice before 5.1.4 allows remote attackers to execute arbitrary code via a crafted RTF file, related to stylesheet and superscript tokens.","status":"published","published":"2016-07-08T19:00:00Z","modified":"2024-08-06T00:25:14Z","updated_at":"2026-11-03T02:22:46.750795Z"}],"ghsa":[{"id":"GHSA-fhmw-mf54-383v","title":"Use-after-free vulnerability in LibreOffice before 5.1.4 allows remote attackers to execute...","description":"Use-after-free vulnerability in LibreOffice before 5.1.4 allows remote attackers to execute arbitrary code via a crafted RTF file, related to stylesheet and superscript tokens.","status":"published","published":"2022-05-17T02:37:31Z","modified":"2025-04-12T13:02:51Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:01:28.663035Z"}],"nvd":[{"id":"CVE-2016-4324","description":"Use-after-free vulnerability in LibreOffice before 5.1.4 allows remote attackers to execute arbitrary code via a crafted RTF file, related to stylesheet and superscript tokens.","status":"published","published":"2016-07-08T19:59:00.143Z","modified":"2026-06-17T00:47:20.98Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:03:27.736698Z"}],"osv":[{"id":"CVE-2016-4324","description":"Use-after-free vulnerability in LibreOffice before 5.1.4 allows remote attackers to execute arbitrary code via a crafted RTF file, related to stylesheet and superscript tokens.","status":"published","published":"2016-07-08T19:59:00.143Z","modified":"2026-10-24T10:30:54.278057795Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:02.454775Z"},{"id":"DEBIAN-CVE-2016-4324","description":"Use-after-free vulnerability in LibreOffice before 5.1.4 allows remote attackers to execute arbitrary code via a crafted RTF file, related to stylesheet and superscript tokens.","status":"published","published":"2016-07-08T19:59:00.143Z","modified":"2026-09-22T07:02:04.695966097Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:27.627285Z"},{"id":"UBUNTU-CVE-2016-4324","description":"Use-after-free vulnerability in LibreOffice before 5.1.4 allows remote attackers to execute arbitrary code via a crafted RTF file, related to stylesheet and superscript tokens.","status":"published","published":"2016-06-29T00:00:00Z","modified":"2026-04-22T10:43:19.816306Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:12.261906Z"},{"id":"DLA-581-1","title":"libreoffice - security update","status":"published","published":"2016-08-02T00:00:00Z","modified":"2026-03-09T02:09:04.109038Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"DSA-3608-1","title":"libreoffice - security update","status":"published","published":"2016-06-29T00:00:00Z","modified":"2026-03-09T01:22:22.887323Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"MGASA-2016-0246","title":"Updated libreoffice packages fix security vulnerability","description":"Updated libreoffice packages fix security vulnerability:\n\nParsing the Rich Text Format character style index was insufficiently checked\nfor validity. Documents can be constructed which dereference an iterator to\nthe first entry of an empty STL container (CVE-2016-4324).\n","status":"published","published":"2016-07-08T19:50:51Z","modified":"2026-04-16T06:24:15.133922912Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"openSUSE-SU-2024:10006-1","title":"libreoffice-5.2.3.3-2.2 on GA media","description":"These are all security issues fixed in the libreoffice-5.2.3.3-2.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:27:04.490196Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"SUSE-SU-2016:2472-1","title":"Security update for libreoffice","description":"\nLibreOffice was updated to version 5.1.5.2, bringing enhancements and bug fixes.\n\n- CVE-2016-4324: Parsing the Rich Text Format character style index was insufficiently\n  checked for validity. Documents could be constructed which dereference an iterator to\n  the first entry of an empty STL container. (bsc#987553)\n- Don't use 'nullable' for introspection, as it isn't available on SLE 12's version\n  of gobject-introspection. This prevents a segmentation fault in gnome-documents.\n  (bsc#1000102)\n","status":"published","published":"2016-10-06T16:57:12Z","modified":"2026-02-04T03:51:16.144614Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"USN-3022-1","title":"libreoffice vulnerability","description":"It was discovered that LibreOffice incorrectly handled RTF document files.\nIf a user were tricked into opening a specially crafted RTF document, a\nremote attacker could cause LibreOffice to crash, and possibly execute\narbitrary code.\n","status":"published","published":"2016-06-29T23:55:23Z","modified":"2026-04-22T09:26:03.780306Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}