Buffer overflow on UPX decompression, array overflow on PDF parsing.
vulners.com/securityvulns/securityvulns:doc:29200
vulners.com/securityvulns/securityvulns:doc:29286