Description
LibreOffice 3.5.x before 3.5.7.2 and 3.6.x before 3.6.1, and OpenOffice.org (OOo), allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted (1) odt file to vcllo.dll, (2) ODG (Drawing document) file to svxcorelo.dll, (3) PolyPolygon record in a .wmf (Window Meta File) file embedded in a ppt (PowerPoint) file to tllo.dll, or (4) xls (Excel) file to scfiltlo.dll.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libreoffice | 1:3.5.4+dfsg-3 | — |
| Debian 13 | libreoffice | 1:3.5.4+dfsg-3 | — |
| Debian 12 | libreoffice | 1:3.5.4+dfsg-3 | — |
| Debian 6.0 | openoffice.org | 1:3.2.1-11+squeeze8 | DSA-2570-1 |
Advisories 1
- DSA-2570-1 openoffice.org - remote Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://cgit.freedesktop.org/libreoffice/core/commit/?h=libreoffice-3-5-7&id=44bc6b5cac723b52df40fbef026e99b7119d8a69
- libreoffice-svxcorelo-dos(79730) vdb-entry
- openSUSE-SU-2012:1686 vendor-advisory
- libreoffice-ppt-file-dos(79731) vdb-entry
- http://cgit.freedesktop.org/libreoffice/core/commit/?h=libreoffice-3-5-7&id=6789ec4c1a9c6af84bd62e650a03226a46365d97
- [oss-security] 20121102 Re: CVE-2012-4233: multiple null pointer dereference flaws in LibreOffice/OpenOffice.org mailing-list
- http://cgit.freedesktop.org/libreoffice/binfilter/commit/?h=libreoffice-3-5-7&id=7e22ee55ffc9743692f3ddb93e59dd4427029c5b
- libreoffice-odt-dos(79728) vdb-entry
- http://www.libreoffice.org/advisories/cve-2012-4233/
- libreoffice-xls-dos(79732) vdb-entry
- 56352 vdb-entry
- DSA-2570 vendor-advisory
- http://cgit.freedesktop.org/libreoffice/core/commit/?h=libreoffice-3-5-7&id=8ca9fb05c9967f11670d045886438ddfa3ac02a7
- openSUSE-SU-2012:1523 vendor-advisory
- https://www.htbridge.com/advisory/HTB23106