CVE-2012-2149

The WPXContentListener::_closeTableRow function in WPXContentListener.cpp in libwpd 0.8.8, as used by OpenOffice.org (OOo) before 3.4, allows remote attackers to execute arbitrary code via a crafted Wordperfect .WPD document that causes a negative array index to be used. NOTE: some sources report this issue as an integer overflow.

• CWE-189

• http://archives.neohapsis.com/archives/bugtraq/2012-05/0090.html
• http://packetstormsecurity.org/files/112862/libwpd-WPXContentListener-_closeTableRow-Memory-Overwrite.htmlExploit, Third Party Advisory, VDB Entry
• http://rhn.redhat.com/errata/RHSA-2012-1043.htmlThird Party Advisory
• http://secunia.com/advisories/46992Vendor Advisory
• http://secunia.com/advisories/60799Third Party Advisory, VDB Entry
• http://www.gentoo.org/security/en/glsa/glsa-201408-19.xml
• http://www.openoffice.org/security/cves/CVE-2012-2149.htmlVendor Advisory
• http://www.securityfocus.com/bid/53570Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id?1027069Third Party Advisory, VDB Entry
• https://www.sec-consult.com/files/20120518-0_openoffice_memory_overwrite.txtExploit
• http://archives.neohapsis.com/archives/bugtraq/2012-05/0090.html
• http://packetstormsecurity.org/files/112862/libwpd-WPXContentListener-_closeTableRow-Memory-Overwrite.htmlExploit, Third Party Advisory, VDB Entry
• http://rhn.redhat.com/errata/RHSA-2012-1043.htmlThird Party Advisory
• http://secunia.com/advisories/46992Vendor Advisory
• http://secunia.com/advisories/60799Third Party Advisory, VDB Entry
• http://www.gentoo.org/security/en/glsa/glsa-201408-19.xml
• http://www.openoffice.org/security/cves/CVE-2012-2149.htmlVendor Advisory
• http://www.securityfocus.com/bid/53570Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id?1027069Third Party Advisory, VDB Entry
• https://www.sec-consult.com/files/20120518-0_openoffice_memory_overwrite.txtExploit

Published

Jun 21, 2012

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2012-2143The crypt_des (aka DES-based crypt) function in FreeBSD befo…
• CVE-2012-2144Session fixation vulnerability in OpenStack Dashboard (Horiz…
• CVE-2012-2145Apache Qpid 0.17 and earlier does not properly restrict inco…
• CVE-2012-2146Elixir 0.8.0 uses Blowfish in CFB mode without constructing …
• CVE-2012-2147munin-cgi-graph in Munin 2.0 rc4 allows remote attackers to …
• CVE-2012-2148An issue exists in the property replacements feature in any …3.3
• CVE-2012-2150xfs_metadump in xfsprogs before 3.2.4 does not properly obfu…
• CVE-2012-2151Multiple cross-site scripting (XSS) vulnerabilities in SPIP …
• CVE-2012-2152Stack-based buffer overflow in the get_packet method in sock…
• CVE-2012-2153Drupal 7.x before 7.14 does not properly restrict access to …
• CVE-2012-2154Cross-site scripting (XSS) vulnerability in the CDN2 Video m…
• CVE-2012-2155Cross-site request forgery (CSRF) vulnerability in the CDN2 …