CVE-2012-1149

Published: Jun 21, 2012Modified: Apr 29, 2026

7.5

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 10.0 / Impact: 6.4

Source: NVD

Description

Integer overflow in the vclmi.dll module in OpenOffice.org (OOo) 3.3, 3.4 Beta, and possibly earlier, and LibreOffice before 3.5.3, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted embedded image object, as demonstrated by a JPEG image in a .DOC file, which triggers a heap-based buffer overflow.

Affected (14)

Products: Libreoffice: Libreoffice · Debian: Debian Linux · Redhat: Enterprise Linux, Enterprise Linux Desktop, Enterprise Linux Server, Enterprise Linux Server Aus, Enterprise Linux Server Eus, Enterprise Linux Workstation · +2 more

Show all products

Libreoffice: Libreoffice · Debian: Debian Linux · Redhat: Enterprise Linux, Enterprise Linux Desktop, Enterprise Linux Server, Enterprise Linux Server Aus, Enterprise Linux Server Eus, Enterprise Linux Workstation · Apache: Openoffice.org · Fedoraproject: Fedora

1 product

1 product

6 products

Enterprise Linux Desktop

Enterprise Linux Server

Enterprise Linux Server Aus

Enterprise Linux Server Eus

Enterprise Linux Workstation

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Libreoffice Libreoffice	Up to 3.5.2

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 6.0
Debian Debian Linux	Version 7.0

Configuration C

7 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux	Version 5.0
Redhat Enterprise Linux Desktop	Version 5.0
Redhat Enterprise Linux Desktop	Version 6.0
Redhat Enterprise Linux Server	Version 6.0
Redhat Enterprise Linux Server Aus	Version 6.2
Redhat Enterprise Linux Server Eus	Version 6.2.z
Redhat Enterprise Linux Workstation	Version 6.0

Configuration D

2 vulnerable

Vulnerable Software	Affected Versions
Apache Openoffice.org	Version 3.3.0
Apache Openoffice.org	Version 3.4 beta

Configuration E

2 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 15
Fedoraproject Fedora	Version 16

Related CWEs

CWE-189

References (46)

http://archives.neohapsis.com/archives/bugtraq/2012-05/0089.html

Source: secalert@redhat.com

Broken Link

http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082168.html

Source: secalert@redhat.com

Third Party Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2012-May/081319.html

Source: secalert@redhat.com

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2012-0705.html

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/46992

Source: secalert@redhat.com

http://secunia.com/advisories/47244

Source: secalert@redhat.com

http://secunia.com/advisories/49140

Source: secalert@redhat.com

http://secunia.com/advisories/49373

Source: secalert@redhat.com

http://secunia.com/advisories/49392

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/50692

Source: secalert@redhat.com

http://secunia.com/advisories/60799

Source: secalert@redhat.com

http://security.gentoo.org/glsa/glsa-201209-05.xml

Source: secalert@redhat.com

Third Party Advisory

http://securitytracker.com/id?1027068

Source: secalert@redhat.com

PatchThird Party AdvisoryVDB Entry

http://www.debian.org/security/2012/dsa-2473

Source: secalert@redhat.com

Third Party Advisory

http://www.debian.org/security/2012/dsa-2487

Source: secalert@redhat.com

Third Party Advisory

http://www.gentoo.org/security/en/glsa/glsa-201408-19.xml

Source: secalert@redhat.com

Third Party Advisory

http://www.libreoffice.org/advisories/cve-2012-1149/

Source: secalert@redhat.com

Vendor Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2012:090

Source: secalert@redhat.com

Broken Link

http://www.mandriva.com/security/advisories?name=MDVSA-2012:091

Source: secalert@redhat.com

Broken Link

http://www.openoffice.org/security/cves/CVE-2012-1149.html

Source: secalert@redhat.com

Third Party Advisory

http://www.osvdb.org/81988

Source: secalert@redhat.com

Broken Link

http://www.securityfocus.com/bid/53570

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

https://exchange.xforce.ibmcloud.com/vulnerabilities/75692

Source: secalert@redhat.com

http://archives.neohapsis.com/archives/bugtraq/2012-05/0089.html