Corel WordPerfect Office X5 (wpd) Remote Buffer Preoccupation PoC

ID ZSL-2010-4945
Type zeroscience
Reporter Gjoko Krstic
Modified 2010-07-12T00:00:00


Title: Corel WordPerfect Office X5 (wpd) Remote Buffer Preoccupation PoC
Advisory ID: ZSL-2010-4945
Type: Local/Remote
Impact: System Access, DoS
Risk: (4/5)
Release Date: 12.07.2010


Corel® WordPerfect® Office X5 – Standard Edition is the essential office suite for word processing, spreadsheets, presentations and email. Chosen over Microsoft® Office by millions of longtime users, it integrates the latest productivity software with the best of the Web. Work faster and collaborate more efficiently with all-new Web services, new Microsoft® Office SharePoint® support, more PDF tools and even better compatibility with Microsoft Office. It's everything you expect in an office suite—for less.


Corel WordPerfect is prone to a remote buffer overflow vulnerability because the application fails to perform adequate boundary checks on user supplied input with .WPD (WordPerfect Document) file. Attackers may exploit this issue to execute arbitrary code in the context of the application. Failed attacks will cause denial-of-service conditions.


Corel Corporation - <>

Affected Version (Standard Edition)

Tested On

Microsoft Windows XP Professional SP3 (English)

Vendor Status

[09.07.2010] Vulnerability discovered.
[09.07.2010] Initial contact with the vendor.
[12.07.2010] No reply from vendor.
[12.07.2010] Public advisory released.




Vulnerability discovered by Gjoko Krstic - <>


[1] <>
[2] <>
[3] <>
[4] <>
[5] <>
[6] <>


[12.07.2010] - Initial release
[13.07.2010] - Added reference [2] and [3]
[15.07.2010] - Added reference [4]
[12.08.2010] - Added reference [5] and [6]


Zero Science Lab

Web: <>

                                            &lt;html&gt;&lt;head&gt;&lt;title&gt;403 Nothing to see.&lt;/title&gt;
&lt;link rel="Shortcut Icon" href="favicon.ico" type="image/x-icon"&gt;
&lt;style type="text/css"&gt;
body {
	background-color: #000;
body,td,th {
	font-family: Verdana, Geneva, sans-serif;
a:link {
	color: #008FEF;
	text-decoration: none;
a:visited {
	color: #008FEF;
	text-decoration: none;
a:hover {
	text-decoration: underline;
	color: #666;
a:active {
	text-decoration: none;
&lt;body bgcolor=black&gt;
&lt;font color="#7E88A3" size="2"&gt;
&lt;br /&gt;&lt;br /&gt;
&lt;h1&gt;403 Nothing to see.&lt;/h1&gt;

You do not have the powah for this request /403.shtml&lt;br /&gt;&lt;br /&gt;
&lt;font size="2"&gt;&lt;a href=""&gt;;/a&gt;&lt;/font&gt;