CVE-2012-2149

The WPXContentListener::_closeTableRow function in WPXContentListener.cpp in libwpd 0.8.8, as used by OpenOffice.org (OOo) before 3.4, allows remote attackers to execute arbitrary code via a crafted Wordperfect .WPD document that causes a negative array index to be used. NOTE: some sources report this issue as an integer overflow.

CVSS v2.0 NVD

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

13.82% chance of exploitation in the next 30 days, 96th percentile

Published

2012-06-21

Updated

2024-08-06

Proof-of-concept exploits (1)

• http://packetstormsecurity.org/files/112862/libwpd-WPXContentListener-_closeTableRow-Memo…

Security advisories

• http://secunia.com/advisories/46992
• http://www.openoffice.org/security/cves/CVE-2012-2149.html
• http://rhn.redhat.com/errata/RHSA-2012-1043.html
• http://secunia.com/advisories/60799
• http://www.securityfocus.com/bid/53570
• http://www.securitytracker.com/id?1027069

References

• CVE Record
• NVD entry