CVE-2012-2149

The WPXContentListener::_closeTableRow function in WPXContentListener.cpp
in libwpd 0.8.8, as used by OpenOffice.org (OOo) before 3.4, allows remote
attackers to execute arbitrary code via a crafted Wordperfect .WPD document
that causes a negative array index to be used. NOTE: some sources report
this issue as an integer overflow.

Bugs

• <https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-2149&gt;