CVE-2012-2149 The WPXContentListener::_closeTableRow function in WPXContentListener.cpp in libwpd 0.8.8, as used by OpenOffice.org (OOo) before 3.4, allows remote attackers to execute arbitrary code via a crafted W...
HighCVSS 7.5
EPSS 13.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The WPXContentListener::_closeTableRow function in WPXContentListener.cpp in libwpd 0.8.8, as used by OpenOffice.org (OOo) before 3.4, allows remote attackers to execute arbitrary code via a crafted Wordperfect .WPD document that causes a negative array index to be used. NOTE: some sources report this issue as an integer overflow.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libwpd(Debian:12) | < 0.8.14-1 | 0.8.14-1 |
| debian/libwpd(Debian:13) | < 0.8.14-1 | 0.8.14-1 |
| debian/libwpd(Debian:14) | < 0.8.14-1 | 0.8.14-1 |
| redhat enterprise linux optional productivity applications | All versions | No fix listed |
| redhat enterprise linux desktop | = 5.0 | No fix listed |
| apache openoffice.org | <= 3.4 | No fix listed |
| apache openoffice.org | = 3.3 | No fix listed |
| libwpd | = 0.8.8 | No fix listed |
References
- Debian Security Tracker CVE-2012-2149 vendor-advisory
- 20120516 CVE-2012-2149 OpenOffice.org memory overwrite vulnerability mailing-list
- packetstormsecurity.org exploit third-party-advisory vdb-entry
- RHSA-2012:1043 third-party-advisory vendor-advisory
- 46992 third-party-advisory vendor-advisory
- 60799 third-party-advisory vdb-entry
- GLSA-201408-19 vendor-advisory
- www.openoffice.org vendor-advisory
- 53570 third-party-advisory vdb-entry
- 1027069 third-party-advisory vdb-entry
- www.sec-consult.com exploit