CVE-2012-1149

high · 7.5

Integer overflow in the vclmi.dll module in OpenOffice.org (OOo) 3.3, 3.4 Beta, and possibly earlier, and LibreOffice before 3.5.3, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted embedded image object, as demonstrated by a JPEG image in a .DOC file, which triggers a heap-based buffer overflow.

7.5

CVSS

14.2%

EPSS (exploit prob.)

96th

EPSS percentile

2012-06-21

Published

AV:N/AC:L/Au:N/C:P/I:P/A:P

Weaknesses

CWE-189

Affected products

Vendor	Product	Affected versions
libreoffice	libreoffice	<= 3.5.2
debian	debian_linux	6.0
debian	debian_linux	7.0
redhat	enterprise_linux	5.0
redhat	enterprise_linux_desktop	5.0
redhat	enterprise_linux_desktop	6.0
redhat	enterprise_linux_server	6.0
redhat	enterprise_linux_server_aus	6.2
redhat	enterprise_linux_server_eus	6.2.z
redhat	enterprise_linux_workstation	6.0
apache	openoffice.org	3.3.0
apache	openoffice.org	3.4
fedoraproject	fedora	15
fedoraproject	fedora	16

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2012-1149