CVE-2012-1149

Name	CVE-2012-1149
Description	Integer overflow in the vclmi.dll module in OpenOffice.org (OOo) 3.3, 3.4 Beta, and possibly earlier, and LibreOffice before 3.5.3, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted embedded image object, as demonstrated by a JPEG image in a .DOC file, which triggers a heap-based buffer overflow.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
References	DSA-2473-1, DSA-2487-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libreoffice (PTS)	buster	1:6.1.5-3+deb10u7	fixed
	buster (security)	1:6.1.5-3+deb10u4	fixed
	bullseye (security), bullseye	1:7.0.4-4+deb11u4	fixed
	bookworm, sid	4:7.4.5-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
libreoffice	source	(unstable)	1:3.4.5-1
openoffice.org	source	squeeze	1:3.2.1-11+squeeze6	DSA-2487-1
openoffice.org	source	(unstable)	1:3.3.0-1

Since 3.3.0 openoffice.org is a transitional source package to migrate to libreoffice