Integer underflow in filter/ww8/ww8par2.cxx in OpenOffice.org (OOo) before 3.2 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted sprmTDefTable table property modifier in a Word document.
The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Openoffice | Apache | * | 3.2.0 (excluding) |
| Red Hat Enterprise Linux 3 | RedHat | openoffice.org-0:1.1.2-46.2.0.EL3 | * |
| Red Hat Enterprise Linux 4 | RedHat | openoffice.org-0:1.1.5-10.6.0.7.EL4.3 | * |
| Red Hat Enterprise Linux 4 | RedHat | openoffice.org2-1:2.0.4-5.7.0.6.1.el4_8.3 | * |
| Red Hat Enterprise Linux 5 | RedHat | openoffice.org-1:2.3.0-6.11.el5_4.4 | * |
| Openoffice.org | Ubuntu | dapper | * |
| Openoffice.org | Ubuntu | hardy | * |
| Openoffice.org | Ubuntu | intrepid | * |
| Openoffice.org | Ubuntu | jaunty | * |
| Openoffice.org | Ubuntu | karmic | * |
| Openoffice.org | Ubuntu | upstream | * |