Description
Integer overflow in the vclmi.dll module in OpenOffice.org (OOo) 3.3, 3.4 Beta, and possibly earlier, and LibreOffice before 3.5.3, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted embedded image object, as demonstrated by a JPEG image in a .DOC file, which triggers a heap-based buffer overflow.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libreoffice | 1:3.4.5-1 | — |
| Debian 13 | libreoffice | 1:3.4.5-1 | — |
| Debian 12 | libreoffice | 1:3.4.5-1 | — |
| Debian 6.0 | openoffice.org | 1:3.2.1-11+squeeze5 | DSA-2487-1, DSA-2473-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | autocorr-af +135 | 1:3.2.1-19.6.el6_2.7 | RHSA-2012:0705 |
| RHEL 5 | openoffice.org +77 | 1:3.1.1-19.10.el5_8.3 | RHSA-2012:0705 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Productivity 5 | openoffice.org +77 | 1:3.1.1-19.10.el5_8.3 | RHSA-2012:0705 |
Advisories 3
- RHSA-2012:0705 Red Hat Security Advisory: openoffice.org security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- DSA-2487-1 openoffice.org - buffer overflow Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-2473-1 openoffice.org - buffer overflow Debian Security (DSA / DLA) · Mar 9, 2026
References
- 60799 third-party-advisory
- GLSA-201408-19 vendor-advisory
- GLSA-201209-05 vendor-advisory
- 20120516 CVE-2012-1149 OpenOffice.org integer overflow error in vclmi.dll module when allocating memory for an embedded image object mailing-list
- 81988 vdb-entry
- MDVSA-2012:090 vendor-advisory
- DSA-2473 vendor-advisory
- FEDORA-2012-8114 vendor-advisory
- 49140 third-party-advisory
- 53570 vdb-entry
- http://www.openoffice.org/security/cves/CVE-2012-1149.html
- DSA-2487 vendor-advisory
- 46992 third-party-advisory
- 47244 third-party-advisory
- 49392 third-party-advisory
- 49373 third-party-advisory
- 50692 third-party-advisory
- http://www.libreoffice.org/advisories/cve-2012-1149/
- RHSA-2012:0705 vendor-advisory
- FEDORA-2012-8042 vendor-advisory
- MDVSA-2012:091 vendor-advisory
- openoffice-vclmi-bo(75692) vdb-entry
- 1027068 vdb-entry