Memory coruption on RTF parsing, memory corruption on CSS parsing.
vulners.com/securityvulns/securityvulns:doc:19834
vulners.com/securityvulns/securityvulns:doc:19835
vulners.com/securityvulns/securityvulns:doc:19836
vulners.com/securityvulns/securityvulns:doc:19837