Multiple buffer overflows in LaTeX2rtf 1.9.15 and possibly other versions allow remote attackers to execute arbitrary code via (1) the expandmacro function and possibly (2) Environments and (3) TranslateCommand.