Threat database

Antiword versions up to 0.37 contain a stack out-of-bounds read vulnerability in the functions vGet8PapInfo and vGet8ChrInfo within prop8.c. This occurs because FKP run counts and grpprl offsets are not properly bounded, allowing a crafted .doc file with malicious FKP pages to read beyond a 512-byte stack buffer. This can lead to application crashes or corrupted style parsing.

Antiword versions up to 0.37 contain a heap out-of-bounds read vulnerability in the vGet8LstInfo function within prop8.c. This flaw is due to an inverted bounds check on the PlcfLst record count, allowing a crafted Word 8 .doc file to specify an excessive number of LSTF records in a small buffer. This causes reads beyond the allocated heap memory, leading to process crashes.