What’s Vulnerable › Vulnerabilities

CVE-2012-1149

• Severity: high (CVSS 7.5 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 14.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2012-06-21 · updated 2026-06-16
• Weakness: CWE-189

Description

Integer overflow in the vclmi.dll module in OpenOffice.org (OOo) 3.3, 3.4 Beta, and possibly earlier, and LibreOffice before 3.5.3, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted embedded image object, as demonstrated by a JPEG image in a .DOC file, which triggers a heap-based buffer overflow.

Affected products

• Apache Openoffice.Org: 3.3.0, 3.4-beta
• Debian Linux: 6.0, 7.0
• Fedoraproject Fedora: 15, 16
• The Document Foundation LibreOffice: through 3.5.2
• Red Hat Enterprise Linux: 5.0
• RedHat Enterprise Linux Desktop: 5.0, 6.0
• RedHat Enterprise Linux Server: 6.0
• RedHat Enterprise Linux Server Aus: 6.2
• RedHat Enterprise Linux Server Eus: 6.2.z
• RedHat Enterprise Linux Workstation: 6.0

References

• http://archives.neohapsis.com/archives/bugtraq/2012-05/0089.html
• http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082168.html
• http://lists.fedoraproject.org/pipermail/package-announce/2012-May/081319.html
• http://rhn.redhat.com/errata/RHSA-2012-0705.html
• http://secunia.com/advisories/46992
• http://secunia.com/advisories/47244
• http://secunia.com/advisories/49140
• http://secunia.com/advisories/49373
• http://secunia.com/advisories/49392
• http://secunia.com/advisories/50692
• http://secunia.com/advisories/60799
• http://security.gentoo.org/glsa/glsa-201209-05.xml

Get alerted when CVE-2012-1149 or the next vulnerability affects your stack