UnRTF allows remote attackers to cause a denial of service (out-of-bounds memory access and crash) and possibly execute arbitrary code via a crafted RTF file.

Michal Zalewski reported [1] an out-of-bounds memory access vulnerability in unrtf. Processing a malformed RTF file could lead to a segfault while accessing a pointer that may be under the attacker's control. This would lead to a denial of service (application crash) or, potentially, the execution of arbitrary code.

Hanno Böck also reported [2] a number of other crashes in unrtf.

There has been no response upstream regarding this (it seems that unrtf is no longer being maintained) so there is no patch available as of yet.

[1] https://lists.gnu.org/archive/html/bug-unrtf/2014-11/msg00001.html [2] https://lists.gnu.org/archive/html/bug-unrtf/2014-11/msg00000.html

It was found that unrtf is vulnerable to multiple buffer overflow flaws in cmd functions. If any exposed application uses unrtf to process untrusted input, these flaws might lead to a denial-of-service.

References:

http://seclists.org/oss-sec/2016/q4/786

Originally reported in:

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=849705

Patch:

http://hg.savannah.gnu.org/hgweb/unrtf/rev/3b16893a6406