LibreOffice '.rtf' File Importing Denial of Service Vulnerability

Bugtraq ID:	71313
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2014-9093
Remote:	Yes
Local:	No
Published:	Nov 26 2014 12:00AM
Updated:	Jul 05 2016 09:41PM
Credit:	Alexander Cherepanov
Vulnerable:	Gentoo Linux Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64
Not Vulnerable:

LibreOffice '.rtf' File Importing Denial of Service Vulnerability

LibreOffice is prone to a denial-of-service vulnerability.

Successfully exploiting this issue may cause the application to crash, resulting in denial-of-service conditions. Given the nature of this issue, attackers may also be able to execute arbitrary code, but this has not been confirmed.

LibreOffice 3.5.4 is vulnerable; other versions may also be affected.

LibreOffice '.rtf' File Importing Denial of Service Vulnerability

An attacker can exploit this issue using readily available tools.

LibreOffice '.rtf' File Importing Denial of Service Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

LibreOffice '.rtf' File Importing Denial of Service Vulnerability

References:

• Bug 86449 - Crash importing malformed .rtf (Alexander Cherepanov)
  
• LibreOffice Homepage (LibreOffice)
  
• Re: CVE Request: LibreOffice -- several issues (MITRE CVE Numbering Authority)