Few integer overflows on Microsoft Word document parsing.
vulners.com/securityvulns/securityvulns:doc:14835
vulners.com/securityvulns/securityvulns:doc:14836