Antiword through 0.37 contains a heap out-of-bounds read vulnerability in vGet8LstInfo in prop8.c caused by an inverted bounds check on the PlcfLst record count.
Antiword through 0.37 contains a stack out-of-bounds read vulnerability in vGet8PapInfo and vGet8ChrInfo in prop8.c because FKP run counts and grpprl offsets are not bounded.
Buffer overflow in the bGetPPS function in wordole.c in Antiword 0.37 allows remote attackers to cause a denial of service (crash) via a crafted document.
